Articles & Snippets

How to Fix the "Impediment: COMPLETELY_EXCLUDED" AutoSSL Error in cPanel

Posted by negraru on Thu, 11 Jun 2026

If AutoSSL is failing with the message "Impediment: COMPLETELY_EXCLUDED", you are not alone. Many server administrators started seeing this issue after recent cPanel updates when creating new hosting accounts or adding new domains.

Error: Impediment: COMPLETELY_EXCLUDED

What Causes This Error?

Recent cPanel updates changed how AutoSSL behaves for newly created domains and accounts. New domains may be automatically excluded from AutoSSL, preventing Let's Encrypt or other AutoSSL providers from issuing SSL certificates.

As a result, AutoSSL checks fail and display the COMPLETELY_EXCLUDED message.

The Fix

Create or edit the following file:

/var/cpanel/panel.ini

Add the following configuration:

[global]
ssl.autossl_in_unified = true
autossl.exclude_new_domains = false

What These Settings Do

Setting	Purpose
`ssl.autossl_in_unified = true`	Restores AutoSSL controls within the unified SSL interface.
`autossl.exclude_new_domains = false`	Automatically includes newly added domains in AutoSSL.

Apply the Changes

After saving the file, rebuild the cPanel configuration:

/usr/local/cpanel/bin/build_global_cache

Then run AutoSSL manually:

/usr/local/cpanel/bin/autossl_check --all

Verify the Domain Is Included

SSL/TLS Status
Check that the domain is marked as Included
Run AutoSSL again if needed

If the domain was previously excluded, the Include option should reappear after applying the configuration above.

If the Issue Persists

Some administrators have reported that existing exclusions may remain attached to individual cPanel accounts. In those cases:

Log in directly to the affected cPanel account.
Open SSL/TLS Status.
Verify the domain is included in AutoSSL.
Run AutoSSL again.

Also confirm that DNS records are correctly configured and point to the server. AutoSSL cannot validate domains with incorrect DNS settings.

Tip: If you manage multiple cPanel servers, consider adding these settings to your server provisioning process so new domains are automatically included in AutoSSL going forward.

Final Thoughts

The COMPLETELY_EXCLUDED error is typically caused by new domains being excluded from AutoSSL by default. Updating the panel.ini configuration and re-enabling automatic inclusion resolves the issue in most environments and restores normal SSL certificate provisioning.

cPanel WHM Let's Encrypt SSL TLS AutoSSL