Why does whm.domain.tld display as unsecured where cpanel.domain.tld is secured?
The prefix (whm, cpanel, webdisk, webmail) for domain.tld are set up using the WHM: Service Subdomain Feature.
Though AutoSSL is capable of issuing an SSL cert for whm.domain.tld, the Service Subdomain Feature will not allow that SSL cert to display, unless the account owner is a reseller.
Non-reseller: https://whm.domain.tld (will show as unsecured)
Reller account: https://whm.domain.tls (will display correct SSL Certificate)
This is an intended outcome when using the Service Subdomain Feature.
This is documented in the following location.
"Note: SSL only secures the whm service subdomain for resellers."