# Differences between a cPanel certificate and a traditional CA-issued certificate

> Compare the free AutoSSL certificate cPanel installs, a self-signed certificate and a paid CA certificate, and which to use for your site.

Source: https://helpcenter.ruachost.com/ssl-security/ssl-certificates/differences-between-a-cpanel-certificate-and-a-traditional-ca-issued/

The free SSL certificate that cPanel installs on your site through **AutoSSL** is issued by Let's Encrypt, a recognised certificate authority (CA). Browsers fully trust it, so visitors see the padlock with no warnings. The only certificate made in cPanel that browsers don't trust is a **self-signed** certificate you generate yourself.

## AutoSSL certificates (free, included)

- Issued automatically by Let's Encrypt for every domain on your hosting plan.
- Trusted by all major browsers and operating systems.
- Domain validated (DV): they prove you control the domain.
- Renewed automatically before they expire, so there's nothing to manage.
- Suitable for most websites, including online shops.

See [Your free SSL certificate (AutoSSL with Let's Encrypt)](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-install-ssl-certificate-on-your-site-using-lets-encrypt-ssl/).

## Self-signed certificates

- Generated by you in cPanel under **SSL/TLS**, and signed by your own server rather than a CA.
- Encrypt the connection, but browsers **don't trust** them and show warnings such as *Your connection is not private*.
- Only useful for testing or internal tools, never for a public website.

See [Installing a self-signed SSL certificate](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/installing-a-self-signed-ssl-certificate/).

## Paid CA certificates

- Issued by a commercial CA such as Sectigo, which Ruachost sells.
- Trusted by browsers, just like AutoSSL certificates.
- Available as DV, OV (organisation validated) and EV (extended validation), and as wildcard certificates that cover all subdomains.
- OV and EV certificates confirm your organisation's identity, and come with a warranty from the CA.

See [Buying and activating an SSL certificate](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/ordering-an-ssl-certificate/).

## Key differences

| Feature | AutoSSL (Let's Encrypt) | Self-signed | Paid CA certificate |
| --- | --- | --- | --- |
| **Issuer** | Let's Encrypt (a CA) | Your own server | Commercial CA (e.g. Sectigo) |
| **Browser trust** | Trusted | Not trusted | Trusted |
| **Validation** | DV | None | DV, OV, EV |
| **Renewal** | Automatic | Manual | Manual, before it expires |
| **Cost** | Free | Free | Paid |
| **Best for** | Most websites | Testing only | Businesses that want organisation validation, a wildcard or a warranty |

> **Tip:**
If your site shows a certificate warning even though AutoSSL is on, see [Why AutoSSL didn't issue a certificate](https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/autossl-not-issuing/).

## Related articles

- [Differences between Let's Encrypt and traditional CA certificates](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/differences-between-lets-encrypt-ssl-certificates-and-traditional-ca/)
- [What is an SSL certificate?](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/what-is-an-ssl-certificate/)