Allowing AutoSSL installer access to a website with directory privacy / password protection

The AutoSSL system will automatically check every active domain name on your hosting account and it will attempt to install a new SSL certificate for any websites that do not already have one. The system will create a temporary .txt file in the /.well-known/pki-validation/ directory of each website, the temporary file contains a special SSL validation code, the SSL validation server will attempt to connect to your website and validate the existence of the code, and if everything can be validated AutoSSL will install the new SSL certificate. The process runs every night and it can sometimes take several nights to complete. 

To check the SSL certificate installed on your website, please type your website address into https://sslanalyzer.comodoca.com/

If your website has directory privacy (password protected directories) this will block AutoSSL and you'll need to modify the .htaccess file.

A typical .htaccess file will contain code for directory privacy that is similar to this:

# Htaccess protection
AuthType Basic
AuthName "Directory privacy"
AuthUserFile "/home/username/.htpasswds/public_html/passwd"
Require valid-user
Order deny,allow
deny from all


To allow AutoSSL access to the directory you'll need to add 3 lines of code to the .htaccess, the first line and the last two lines in the example below. We've put the 3 lines in bold below.

SetEnvIfNoCase Request_URI "^/\.well-known/pki-validation/[A-F0-9]{32}.txt$|Comodo\ DCV" ALLOWED=TRUE
# Htaccess protection
AuthType Basic
AuthName "Directory privacy"
AuthUserFile "/home/username/.htpasswds/public_html/passwd"
Require valid-user
Order deny,allow
deny from all
allow from env=ALLOWED
Satisfy any

The code above is only an example. Please keep a copy of your original .htaccess file incase you need to revert it.

Once you have amended the code, please test your website to make sure it's working as you'd expect. If everything is working correctly, AutoSSL will check your website tonight and install a new SSL certificate if necessary. Tomorrow morning you can check for an SSL certificate by typing your website address into https://sslanalyzer.comodoca.com/

The AutoSSL system will check your website(s) every night, or if you prefer not to wait, you can manually request it at any time of the day. Simply login to your cPanel control panel, go to the SSL/TLS Status page, then click the "Run AutoSSL" button. This will usually complete in 10-15 minutes.

If you encounter any issues, please open a support ticket and our team will be happy to investigate.