You type in your server's IP address or an old bookmarked link to get into cPanel or WHM, and instead of the login form you get a full-page red warning: "Your connection is not private" or "NET::ERR_CERT_AUTHORITY_INVALID." Nothing is actually broken — but it's alarming enough that people email support asking if their server got hacked. It didn't. This is almost always a certificate name mismatch, and it's fixable in a few minutes.
Why This Happens
cPanel and WHM run their own login interfaces on dedicated ports: 2083 for cPanel, 2087 for WHM, 2096 for webmail, and 2095 for the old-style webmail. Each of these services needs its own SSL certificate, separate from any certificate installed on your websites. When you visit https://your-server-ip:2083 or https://oldhostname.example.com:2083, the browser checks whether the certificate presented actually matches the address in the URL bar.
Most of the time it doesn't, for one of these reasons:
- You're browsing by IP address. AutoSSL issues certificates for hostnames, never for bare IPs. A cert for
server1.skyserver.inwill never validate againsthttps://203.0.113.45:2083, no matter how correct the setup is. - The hostname changed. If the server's hostname was updated in WHM (say, from a generic
host123.provider.netto your own domain) but the SSL service certificate wasn't reissued afterward, the old cert is still tied to the old name. - DNS points somewhere else now. You're using a bookmark or an old support email that references a hostname whose A record has since moved.
- It's the default self-signed certificate. A freshly provisioned VPS ships with a self-signed cert for the service ports until AutoSSL runs its first pass, which can take a little time after account creation.
None of these mean your data is at risk from someone eavesdropping — the connection is still encrypted, just not verified against the name you typed. But you shouldn't just click through the warning out of habit either, since a genuinely spoofed certificate would look identical. The fix is to make the address and the certificate agree.
Fix 1: Use the Hostname, Not the IP
This solves it for most people in ten seconds. Find your server's actual hostname in WHM under Server Configuration → Basic WebHost Manager Setup, or ask SkyServer support if you're not sure. Then log in using:
https://your-actual-hostname.com:2083instead of the IP address. As long as AutoSSL has issued a valid certificate for that hostname (which it does automatically on most cPanel servers), the warning disappears immediately and you'll see the padlock as expected.
Fix 2: Reissue the Service Certificate After a Hostname Change
If you (or SkyServer support) recently changed the server's hostname, the service certificate needs to be regenerated to match. In WHM:
- Go to SSL/TLS → Manage AutoSSL.
- Under Run AutoSSL, select the option to run it for all users, or specifically for the root/service certificate if that option is shown.
- Wait a few minutes for the run to complete, then check SSL/TLS → Manage Service SSL Certificates to confirm the certificate for cPanel, WHM, and webmail services now lists your current hostname.
If AutoSSL can't validate the hostname (usually because DNS for that hostname doesn't point at the server, or a firewall is blocking the validation request on port 80), it'll fall back to the self-signed cert and you'll keep seeing the warning. Point an A record at the server for that hostname first, then rerun AutoSSL.
Fix 3: Install a Proper SSL Certificate for the Service Ports Manually
If AutoSSL isn't available or you'd rather use a certificate from your own CA, go to WHM → SSL/TLS → Manage Service SSL Certificates, pick the service (cPanel, WHM/cPanel Service, Webmail, etc.), and either paste in a certificate/key/CA bundle you already have, or generate a new self-signed one as a temporary measure. Just remember a manually uploaded certificate needs to be renewed yourself before it expires — AutoSSL won't touch a certificate you installed by hand unless you tell it to.
Fix 4: If You Genuinely Need to Access by IP
Sometimes IP access is unavoidable — DNS isn't live yet, or you're troubleshooting DNS itself. In that case the warning is expected and safe to click through if you're certain you typed the IP correctly and it's your server. Firefox and Chrome both let you proceed via "Advanced → Proceed anyway," but treat that as a one-time exception, not your normal login method. Once DNS is sorted, switch back to the hostname URL.
Quick Reference
| Symptom | Likely Cause | Fix |
|---|---|---|
| Warning only when using the IP | AutoSSL certs are hostname-only | Log in via hostname instead |
| Warning started after a hostname change | Service cert not reissued | Rerun AutoSSL in WHM |
| Warning on a brand-new VPS | Default self-signed cert, AutoSSL hasn't run yet | Wait a few minutes, or trigger AutoSSL manually |
| Cert shows an unfamiliar or expired name | Old DNS/bookmark pointing at a stale hostname | Confirm the current hostname with support, update bookmarks |
Preventing It Going Forward
Bookmark the hostname URL, not the IP — it's the one thing that consistently avoids this. If you're changing your server's hostname for branding reasons, plan to rerun AutoSSL right after and check the service certificates before telling your team the migration is done. And if you manage multiple servers, keep a short internal note of each one's real hostname; "the WHM login for client X" is a lot easier to get wrong than it sounds when you're juggling a dozen IPs.
Frequently Asked Questions
Is my server compromised if I see this warning?
No. This is a name-mismatch issue between the certificate and the address you typed, not evidence of tampering. The connection is still encrypted; the browser just can't confirm the identity matches what you entered. That said, always double-check you typed the correct IP or hostname before proceeding through any SSL warning.
Why does my website's SSL work fine but cPanel/WHM still shows a warning?
Your website and the cPanel/WHM login run on completely separate ports with separate certificates. AutoSSL can renew both, but they're issued and tracked independently — one being valid doesn't guarantee the other is.
Can I just disable the warning permanently?
You can tell your own browser to trust a self-signed certificate, but that only fixes it on that one browser and device, and it won't protect you from a real mismatch later. It's better to fix the underlying certificate so every browser and every login trusts it automatically.
How do I find out what my real cPanel hostname is?
In WHM, go to Server Configuration → Basic WebHost Manager Setup and check the Hostname field. If you don't have WHM access, your SkyServer welcome email or support ticket history will have it, or you can ask support directly.
Does this affect webmail (port 2096) too?
Yes — webmail uses the same service certificate pool as cPanel and WHM. Fixing the hostname/AutoSSL issue for one typically resolves it for all of them, since they're reissued together.
