All domains on a server have SSL issues by DDoS-Filter.domain

Recently on a cPanel/WHM server, all SSLs’ were replaced with self-signed certificates issued by DDoS-Filter.domain

This is an indicator of DDoS protection (mitigation) that was triggered either by a large number of connections to the server/data center or manually by the hosting provider (switching from “Sensor” to “Permanent” mode).

DDoS mitigation has 2 modes:

• Permanent: traffic toward IP is always filtered
• Sensor: the protection is inactive until an attack is detected and mitigation starts

If you notice this SSL contact your hosting provider immediately.