cPanel AutoSSL Let's Encrypt failures: diagnostic guide for expired padlocks and validation errors
A diagnostic guide for cPanel AutoSSL Let's Encrypt issuance and renewal failures: recognize expired padlocks, check DNS resolution and HTTP-01 access, apply fixes tied to findings, and know when to escalate.
15 Aug 2026, 08:26 UTC
Recognizable condition
A domain under a cPanel account shows an expired or invalid padlock in browsers. In cPanel > Security > SSL/TLS Status or AutoSSL, the domain is listed as failed, with messages such as validation failed, certificate not issued, or unable to verify domain. This often appears after DNS changes, adding an addon domain, or after a certificate expiry window passes.
AutoSSL is cPanel's automated system for obtaining and renewing TLS certificates, typically via Let's Encrypt. HTTP-01 validation is the default method: Let's Encrypt requests a token at http://domain/.well-known/acme-challenge/. If the request cannot reach the cPanel server or the domain does not resolve to it, issuance fails.
Cause and diagnostic table
| Observed symptom | Likely cause | Quick check |
|---|---|---|
| AutoSSL error: domain does not resolve to this server | A/AAAA record points to a different IP | External DNS lookup vs server IP |
| Validation failed for /.well-known/acme-challenge/ | HTTP-01 blocked by .htaccess, firewall, or redirect to HTTPS | Fetch validation URL from external network on port 80 |
| Domain excluded from AutoSSL or shows manual SSL | Domain opted out or on a custom certificate | cPanel SSL/TLS Status inclusion list |
| Multiple domains fail with CA connectivity or rate limit | Temporary Let's Encrypt outage or rate limit hit | WHM AutoSSL logs and system-wide status |
Ordered checks
1. Confirm the user-visible symptom and scope
From an external network, open the domain in a browser and check the padlock and certificate expiry. In cPanel, open Security > SSL/TLS Status and note which domains are failed and the per-domain error text. This establishes whether the issue is single domain or account-wide.
2. Verify DNS resolves to the cPanel server
Run an external DNS lookup for the domain and www subdomain. The returned A and AAAA records must match the IP assigned to the cPanel account on this server. Check from outside the hosting network to avoid local resolver caching.
Example command to run from a workstation with dig installed, as any user:
dig +short example.com @8.8.8.8Compare the result to the server IP shown in WHM > Server Information or cPanel > Server Information. If they differ, DNS is the root cause. DNS changes require propagation time; immediate retries will fail.
3. Review AutoSSL status and exclusions
In cPanel > Security > SSL/TLS Status, verify the domain is included in AutoSSL and not marked as excluded or using a manual SSL. In WHM > SSL/TLS > Manage AutoSSL, check the provider is set to Let's Encrypt and the account is not on a manual exclusion list. A domain on a manual certificate will not be renewed by AutoSSL.
4. Check HTTP-01 accessibility on port 80
Let's Encrypt must reach http://domain/.well-known/acme-challenge/ on port 80 without redirects to HTTPS that break the challenge. From an external host, test access to the validation path. Blocking rules in .htaccess, mod_security, or a firewall can return 403/404.
Do not modify web server configuration without confirming the impact on the ACME path, as changes can break validation for all domains.
5. Review recent DNS or account changes
Check the DNS zone in cPanel > Domains > Zone Editor for recent edits to A/AAAA records, and confirm addon domains are correctly assigned to the account. Recent changes are a common trigger for validation failures.
Fixes tied to findings
DNS mismatch
Correct the A/AAAA records to point to the cPanel server IP. Wait for propagation before retrying AutoSSL. Avoid repeatedly forcing AutoSSL runs in a short window, which can trigger Let's Encrypt rate limits and prolong resolution.
Blocked validation path
Identify and remove rules that block /.well-known/acme-challenge/. Common culprits are .htaccess redirects forcing HTTPS or IP deny rules. Ensure port 80 is open and served by Apache for the domain. After remediation, re-run AutoSSL manually for the account via cPanel > Security > SSL/TLS Status > Run AutoSSL.
Domain excluded or manual SSL
If the domain is excluded, include it in AutoSSL in cPanel > Security > SSL/TLS Status. If a manual certificate is in use and renewal is desired via AutoSSL, replace it with an AutoSSL managed certificate after confirming the domain resolves correctly.
Rate limits or CA connectivity
If errors indicate rate limits, pause manual retries and wait for the window to reset. For persistent CA connectivity errors, verify outbound HTTPS access from the server to Let's Encrypt endpoints. This is a server-level check requiring root in WHM.
Verification after remediation
- Confirm domain resolution matches the cPanel server IP using an external DNS lookup.
- Check AutoSSL status inside cPanel for the affected account and confirm the specific validation failure is cleared.
- Verify certificate expiry and padlock status in a browser, and confirm the next AutoSSL renewal window is scheduled.
- Re-run AutoSSL manually once DNS and access issues are cleared and observe success status per domain.
Escalation criteria
Escalate to server administration when:
- Repeated system-wide AutoSSL failures occur across multiple unrelated accounts.
- Persistent CA connectivity errors appear in WHM > Logs > AutoSSL or system logs.
- Rate limit blocks affect new issuances for many domains.
- Errors reference internal WHM services, permissions, or file ownership that cannot be resolved at account level.
Version behavior for AutoSSL providers and UI labels varies across cPanel releases. Assumptions here apply to recent standard builds with AutoSSL enabled and Let's Encrypt configured.
cpanel0 replies
A thoughtful contribution can make all the difference. Be the first to share one.