cPanel AutoSSL Renewals After Experiencing Failure
AutoSSL runs automatically once every 24 hours on the server. During each run, it checks all domains on the account and attempts renewal if:
- The existing certificate is within days of expiry
- The domain resolves correctly to the hosting server
- The domain is publicly reachable
- DNS and nameservers are correctly configured
If all conditions are met, AutoSSL issues a new certificate and installs it automatically. No downtime occurs.
Common Reasons AutoSSL Fails
1. If the domain no longer points to the hosting server, AutoSSL cannot verify it.
Symptoms:
- AutoSSL log shows “DCV challenge failed”
- Certificate does not renew
- Domain resolves to another provider
Fix:
- Update the DNS A record to point back to the hosting server
- Wait for DNS propagation (usually up to 4 hours)
- Run AutoSSL manually in cPanel (optional)
2. AutoSSL cannot validate or renew certificates for expired domains.
Fix:
- Renew the domain with your registrar
- Wait for DNS to reactivate
- AutoSSL will retry automatically within 24 hours
3. Missing or incorrect A/AAAA records will cause validation to fail.
Fix:
- Ensure the domain and any subdomains point to the correct server IP
- Remove AAAA records if IPv6 is not supported
- Avoid CNAME loops or redirects
4. Existing conflicting DNSSEC record on domain
DS record could prevent domain resolution and AutoSSL can’t validate, thus renewal may fail.
Fix:
- Remove the DS record from the domain registrar
- Re-run AutoSSL
5. The domain is behind a proxy (Cloudflare, CDN, firewall)
Some proxies interfere with DCV (Domain Control Validation).
Fix:
- Ensure Cloudflare “Proxy” is disabled (set to DNS‑only) during renewal
- Or add the required AutoSSL validation exceptions if supported
How to Manually Trigger AutoSSL
You can manually run AutoSSL from within cPanel:
- Log in to cPanel
- Go to SSL/TLS Status
- Click Run AutoSSL
This forces an immediate validation attempt and is useful after fixing DNS issues.
Cleaning Up Old or Invalid Domains
If a domain no longer belongs to you or is no longer hosted on the server, AutoSSL will repeatedly fail for it. Thus Remove the domain from Addon Domains, Subdomains, or Aliases in cPanel.
When to Contact Support
Contact support if:
- AutoSSL continues to fail after DNS is corrected
- You are unsure which DNS records to use
- You require a paid or EV/OV SSL certificate instead of AutoSSL