Fixing depth_zero_self_signed_cert in cPanel with a Self-Signed Certificate

Verify the Current SSL Certificate in cPanel

1. Log into cPanel
2. Navigate to SSL/TLS > Manage SSL Sites
3. Find your domain and check the certificate issuer
   • If it says Self-Signed, then your certificate is not trusted.

Alternatively, check from the terminal:

For closely related depth_zero / SSL topics, see depth_zero_self_signed_cert in SSL/TLS, depth_zero in cPanel for Git Operations, and What is _globalsign-domain-verification?.

openssl s_client -connect yourdomain.com:443 -showcerts

Expected output (if self-signed):

verify error:num=18:self-signed certificate
verify return:1
verify error:num=19:self-signed certificate in certificate chain
verify return:1

Install a Trusted SSL Certificate in cPanel

Option 1: Get a Free SSL from AutoSSL (Recommended)

1. Go to cPanel > SSL/TLS Status
2. Click Run AutoSSL
3. Wait for cPanel to issue a free SSL certificate from Let's Encrypt or Sectigo
4. Refresh the page and ensure the status says "Valid"

Restart Apache:

sudo systemctl restart httpd

This will replace the self-signed certificate with a valid one.

Option 2: Install a Manually Signed SSL Certificate

If AutoSSL does not work, you can install a third-party SSL.

Get an SSL Certificate

• Purchase one from Namecheap, GoDaddy, or DigiCert, or
• Get a free Let's Encrypt certificate using certbot.

Install the SSL in cPanel

• Go to SSL/TLS > Manage SSL Sites
• Upload the new certificate (CRT)
• Add the Private Key (KEY)
• Add the Certificate Authority Bundle (CABUNDLE)

Save and restart Apache:

sudo systemctl restart httpd

Add the Self-Signed Certificate to Trusted Store (For Internal Use)

If you must use a self-signed certificate (e.g., for local development), you need to trust it manually.

Add the Certificate to the Server's Trusted CA Store

For Debian/Ubuntu

sudo cp your_certificate.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

For CentOS/RHEL

sudo cp your_certificate.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Restart Apache

sudo systemctl restart httpd

Ignore SSL Verification for Specific Clients (If Necessary)

If you are using a self-signed certificate and cannot install a trusted one, you can disable SSL verification (not recommended for production).

For curl

curl -k https://yourdomain.com

For git

git config --global http.sslVerify false

For Node.js

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Warning: Disabling SSL verification is insecure. Use this only for temporary testing.

Summary of Fixes

Now your cPanel SSL should work correctly!