Fix AutoSSL not issuing certificates in cPanel

When AutoSSL cannot secure a domain, the site keeps a self-signed or expired certificate and visitors see a browser warning. The cause is almost always one of five things: DNS, the validation request being blocked, a redirect, a CAA record or a rate limit. This guide shows how to read the AutoSSL log and fix each one.

Before you start

• Root access to WHM, or at least the cPanel account.
• AutoSSL already enabled with a provider chosen. If not, start with set up AutoSSL in cPanel & WHM.
• The domain and server IP, for example example.com and 203.0.113.10.

Read the AutoSSL log first

In WHM, open SSL/TLS » Manage AutoSSL » Logs. Pick the latest run for the user and find the domain. Each failed name has a line with the reason. On disk:

ls -t /var/cpanel/logs/autossl/ | head -3
grep -rh 'example.com' /var/cpanel/logs/autossl/ | tail -20

In cPanel, Security » SSL/TLS Status also shows each domain with a short failure reason. Match the reason to a section below.

DNS does not point to the server

AutoSSL uses domain control validation (DCV). If the name resolves somewhere else, validation fails.

dig +short example.com A
dig +short www.example.com A
dig +short example.com AAAA

Every answer must be your server IP. Common traps:

• www has no record, or points to an old host.
• An AAAA (IPv6) record points elsewhere. Let's Encrypt prefers IPv6 when it exists. Fix or remove the stale AAAA record.
• A CDN proxy is in front. Validation may still work over HTTP, but if it does not, pause the proxy while AutoSSL runs.

After a DNS change, wait for the old TTL to expire before trying again.

The HTTP check is blocked or redirected

For HTTP validation, the certificate authority fetches a file under /.well-known/ on port 80. Test from outside the server:

mkdir -p /home/USER/public_html/.well-known/acme-challenge
echo ok > /home/USER/public_html/.well-known/acme-challenge/test.txt
curl -i http://example.com/.well-known/acme-challenge/test.txt

You should get 200 OK and ok. Delete the test file afterwards. If not:

• 403 or 404: an .htaccess rule, security plugin or ModSecurity rule blocks the path. Add an exception before other rewrite rules:

  RewriteEngine On
  RewriteRule ^\.well-known/ - [L]

• Redirect to another domain: a redirect sends every request elsewhere. Redirects to HTTPS on the same name are usually fine; redirects to a different host are not.
• Timeout: port 80 is closed in the firewall. Open it.

CAA records block the issuer

A CAA record lists which certificate authorities may issue for the domain. If it exists and does not include Let's Encrypt, issuance fails.

dig +short example.com CAA

If you see records but none mention letsencrypt.org, add one in the Zone Editor, for example a CAA record with tag issue and value letsencrypt.org. No CAA records at all means any authority may issue.

Rate limits

Let's Encrypt limits how many certificates and failed validations a domain can have in a period. If the log mentions rate limits or "too many", stop retrying. Fix the real cause, wait for the window to pass (Let's Encrypt documents the current limits), then run AutoSSL once.

Other causes

• Domain in the excluded list: a user can exclude names from AutoSSL in SSL/TLS Status. Include it again.
• Feature disabled for the user: check Manage AutoSSL » Manage Users.
• Too many names on one certificate: very large accounts with many aliases may exceed limits. Remove unused domains.
• Hostname certificate fails: the server hostname is checked separately. See WHM hostname SSL certificate.

Run AutoSSL again and check it works

Run it just for the affected user from Manage Users » Check, or from SSH:

/usr/local/cpanel/bin/autossl_check --user=USER

Then confirm the live certificate:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

The subject should include your domain and the issuer should be Let's Encrypt.

Troubleshooting

• Works for example.com but not mail.example.com: the service subdomain lacks a DNS record. Add an A record for it.
• Certificate issued but browser still warns: you are viewing a cached old certificate, or NGINX in front needs a rebuild. Clear the browser cache and run /usr/local/cpanel/scripts/ea-nginx config USER if you use ea-nginx.
• Every domain fails at once: outbound connections from the server may be blocked, or the provider is set to Disabled. Check the provider and the firewall.

Next steps

• Point records correctly: manage DNS with cPanel Zone Editor.
• Then redirect visitors: force HTTPS in cPanel.