All domains on a server have SSL issues by DDoS-Filter.domain

Recently on a cPanel/WHM server, all SSLs’ were replaced with self-signed certificates issued by DDoS-Filter.domain


This is an indicator of DDoS protection (mitigation) that was triggered either by a large number of connections to the server/data center or manually by the hosting provider (switching from “Sensor” to “Permanent” mode).

DDoS mitigation has 2 modes:

  • Permanenttraffic toward IP is always filtered
  • Sensor: the protection is inactive until an attack is detected and mitigation starts

If you notice this SSL contact your hosting provider immediately.

Stefan Pejcic
Join the discussion

I enjoy constructive responses and professional comments to my posts, and invite anyone to comment or link to my site.