When AutoSSL is not working, your domain is left with an expired or self-signed certificate and visitors see security warnings. AutoSSL issues free certificates on MdmHost cPanel hosting, but it must prove you control each domain first (domain control validation, DCV). Almost every AutoSSL failure is a DCV failure, and the log tells you exactly which one.
Before you start
- Log in to cPanel from Services in the MdmHost dashboard.
- Know which domains and subdomains should be covered.
Read the AutoSSL log first
- Open cPanel → Security → SSL/TLS Status.
- Click View log next to the latest AutoSSL run, or hover over the red icon beside a domain.
- Look for lines such as DNS DCV: No local authority, HTTP DCV: The system queried for a temporary file … but the web server responded with … 404/403, or CAA.
Common AutoSSL errors and fixes
The domain does not resolve to this server
If the domain's A record points to another IP (an old host, a CDN or nothing), HTTP validation cannot reach your account. Point the A records for the domain and www to the server IP shown in cPanel → General Information, or exclude subdomains you do not use. See domain not resolving.
Validation file blocked (403/404/redirect)
AutoSSL places a file under /.well-known/pki-validation/ or /.well-known/acme-challenge/. Rewrite rules, security plugins or a password-protected folder can block it. Add this near the top of .htaccess so those paths are not rewritten:
RewriteRule ^\.well-known/ - [L]Then check Directory Privacy is not enabled on public_html. Our .htaccess guide helps if the file is complex.
Behind Cloudflare
Cloudflare challenges or caching can break HTTP validation. Make sure "Always Use HTTPS" is not redirecting validation to a broken HTTPS site, or use a Cloudflare origin certificate instead.
CAA record blocks the issuer
A CAA record that only allows another authority stops AutoSSL. Add the issuer AutoSSL uses or remove the restriction. See CAA records.
Unused subdomains failing
Subdomains like mail., cpcalendars. or autodiscover. fail if their DNS points elsewhere. That only affects those names, but you can tidy up with AutoSSL domain exclusions.
Run AutoSSL again
- After fixing the cause, return to SSL/TLS Status.
- Click Run AutoSSL and wait a few minutes.
- Domains should turn green with "AutoSSL Domain Validated".
Note: Certificate authorities rate-limit repeated failures. If you ran AutoSSL many times in a short period, wait an hour after fixing the cause before trying again.
FAQ
How long does AutoSSL take?
Usually a few minutes once validation succeeds.
Does AutoSSL renew automatically?
Yes, it checks daily and renews well before expiry, as long as validation keeps working.
Why is only www failing?
The www record points somewhere else or is missing. Add a CNAME or A record for it.