> ## Documentation Index
> Fetch the complete documentation index at: https://help.noxity.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Wizard

> Issue a new SSL certificate through cPanel's revamped wizard. Pick domains, validate them via HTTP, choose Let's Encrypt as the product, click through.

The Wizard is the front door of the SSL/TLS Certificates tool. The flow was rebuilt by cPanel: pick the domains you want on the certificate, the Wizard validates each one via an HTTP challenge, then you pick the product (Let's Encrypt, on Noxity hosting) and the cert is issued.

Open it from cPanel home → **Security** → **SSL/TLS Certificates** → **Wizard** (default tab).

<Frame caption="Wizard tab with the domain list and Continue button at the bottom">
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/landing-light.png" alt="SSL/TLS Wizard with the domain checklist and Continue button" className="block dark:hidden" />

  <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/landing-dark.png" alt="SSL/TLS Wizard with the domain checklist and Continue button" className="hidden dark:block" />
</Frame>

## What the Wizard does

In one flow:

1. You tick the domains you want on the certificate.
2. cPanel validates each one via HTTP-based Domain Control Validation (the file-on-server test that confirms the A record points at this account).
3. Domains that pass show a green **Validated via HTTP-based Domain Control Validation** badge. Domains that fail show a reason.
4. You click **Continue** with the validated domains, pick the product (Let's Encrypt), and submit.
5. cPanel installs the issued cert on every selected domain automatically.

You don't need to handle CSRs, key pairs, or Apache config. The Wizard is the easy path.

## Issue a Let's Encrypt certificate

<Steps>
  <Step title="Tick the domains">
    Each domain on your account appears in the list, plus its `www`, `mail`, `webmail`, `cpanel`, `cpcalendars`, `cpcontacts`, `webdisk`, and `autodiscover` subdomains. Tick every variant you want covered. For a typical site, that's the bare domain and `www`.

    Wildcards (`*.yourdomain.com`) appear in the list too. Wildcards on Let's Encrypt require DNS-based validation, which Noxity AutoSSL handles automatically when the domain is on our DNS.
  </Step>

  <Step title="Wait for validation">
    cPanel runs the HTTP challenge in the background. Each domain that passes shows the green **Validated via HTTP-based Domain Control Validation** pill.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/validated-light.png" alt="Validated via HTTP-based Domain Control Validation badge" className="block dark:hidden" />

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/validated-dark.png" alt="Validated via HTTP-based Domain Control Validation badge" className="hidden dark:block" />
    </Frame>

    Domains that fail show a reason: DNS not pointing here, the validation file couldn't be served, or a redirect interferes. Fix the underlying issue (usually DNS) and re-run.
  </Step>

  <Step title="Click Continue">
    The bottom of the page shows a summary count of selected domains and a **Continue** button. Click it.
  </Step>

  <Step title="Pick Let's Encrypt as the product">
    A product picker opens. On Noxity hosting, you'll see **Let's Encrypt Certificate** as the only option (basic, free certs). Click **Let's Encrypt Certificate**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/product-light.png" alt="Let's Encrypt Certificate product card" className="block dark:hidden" />

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/noxity/images/cpanel/security-settings/ssl-tls-certificates/wizard/product-dark.png" alt="Let's Encrypt Certificate product card" className="hidden dark:block" />
    </Frame>
  </Step>

  <Step title="Resolve any final issues">
    The last screen surfaces any remaining problems with the request (a domain you ticked that since lost validation, a rate-limit warning from Let's Encrypt, etc.). Address them and submit.
  </Step>

  <Step title="Done">
    cPanel issues the cert, installs it on every domain in the request, and the green padlock in the [Status tab](/web-hosting/cpanel/security-settings/ssl-tls-certificates/status) flips on.
  </Step>
</Steps>

## What "validated via HTTP" actually checks

cPanel writes a small file at `http://yourdomain.com/.well-known/acme-challenge/<token>`. The Let's Encrypt server fetches that URL. If the file is served (status 200, correct contents) the domain is validated.

What can break this:

* The domain's A record doesn't point at your Noxity server. AutoSSL can't validate a domain that resolves elsewhere.
* A redirect rule rewrites `/.well-known/acme-challenge/...` (some `.htaccess` HTTPS-force rules do this). Bypass `/.well-known/` in the rule.
* A WordPress plugin is intercepting the path. Disable the plugin during issuance.
* Cloudflare proxy is on with **Always Use HTTPS** plus an SSL mode that rejects the challenge. Pause Cloudflare proxy on the domain or use the Cloudflare-mode AutoSSL.

## When to use the Wizard vs other tabs

* **Wizard** for free Let's Encrypt certs on domains hosted with us. The default and the easy path.
* **[Requests](/web-hosting/cpanel/security-settings/ssl-tls-certificates/requests)** if you bought a paid cert (DigiCert, Sectigo, GoDaddy) and need to generate a CSR to send to the CA.
* **[Certificates](/web-hosting/cpanel/security-settings/ssl-tls-certificates/certificates)** to upload the issued paid cert once you receive it.
* **[Installation](/web-hosting/cpanel/security-settings/ssl-tls-certificates/installation)** to deploy an uploaded cert onto a domain.

## Common issues

<AccordionGroup>
  <Accordion title="A domain won't validate">
    The domain's A record points somewhere other than your Noxity server (often Cloudflare, sometimes a previous host). Either point DNS here, or use a CNAME-based validation (open a ticket).
  </Accordion>

  <Accordion title="Validation passes but the issued cert won't install">
    A previous cert with the same domains is locked by another part of the system. Open a ticket; we can clear the lock.
  </Accordion>

  <Accordion title="&#x22;Rate limit exceeded&#x22; from Let's Encrypt">
    Let's Encrypt rate-limits issuance to 50 certs per registered domain per week, and 5 duplicate certs per week. If you've been re-issuing in a loop, wait an hour and try again. For repeated production issues, open a ticket.
  </Accordion>

  <Accordion title="The Wizard validated www but not the bare domain">
    The bare domain has a different A record (or no A record at all). DNS first, validation second.
  </Accordion>
</AccordionGroup>

## Need a hand?

<CardGroup cols={2}>
  <Card title="Open a ticket" icon="life-ring" href="https://members.noxity.io/submitticket.php">
    Best for anything that needs an account check or a config change on our end.
  </Card>

  <Card title="Live chat" icon="messages" href="https://noxity.io/contact">
    Faster for quick questions during business hours.
  </Card>
</CardGroup>