AutoSSL DNS-01 retry behavior and propagation handling for wildcard certificates

Direct answer

1. No documented maximum number of DNS-01 validation attempts exists for a single wildcard AutoSSL request.
2. No. The propagation wait interval is not configurable through WHM Manage AutoSSL Providers or a server-wide configuration file.
3. Not explicitly. The autossl_check scheduler generally re-queues domains after DNS-01 failure without documented differentiation between retryable propagation errors and non-retryable provider misconfigurations.

Likely explanation versus confirmed facts

Likely explanation (version-dependent)

• Some cPanel releases, including v100 and later, introduced improved ACME error categorization, but it is undocumented whether that changes re-queue decisions for wildcard DNS-01 failures.
• Earlier cPanel versions may treat all DNS-01 failures uniformly, making a transient propagation delay look like a permanent provider misconfiguration.

Confirmed facts

• Wildcard certificates require DNS-01, and the configured DNS provider must expose API hooks for TXT record creation.
• AutoSSL has no built-in propagation wait or verification step before asking the CA to validate the DNS-01 record.
• Propagation wait intervals are not exposed in WHM Manage AutoSSL Providers or in server-wide configuration files.
• CAA record pre-validation is not performed, so issuance failures surface only after the CA rejects the request.
• If the DNS provider module lacks API hooks, the attempt is non-automatable and requires manual WHM intervention.

Steps for this case

1. Open WHM AutoSSL logs for the affected wildcard domain and record the ACME error code and timestamp.
2. Confirm that the DNS provider module has TXT record API hooks enabled; missing hooks mean no retry interval will resolve the issue.
3. Run uapi --user=username SSL::start_autossl_check to force a new check, or wait for the next scheduled AutoSSL run.
4. Compare the re-queue timestamp against the last attempt to measure the actual retry interval on your server.

Missing diagnostic detail

What cPanel version is installed? The recommendation differs between pre-v100 and v100+ servers because ACME error categorization changed, affecting whether propagation errors can be distinguished from provider misconfigurations.

Verification

whmapi1 autossl_check_logs user=username domain=example.com

Look for DNS-related ACME error codes in the log output. Replace username and example.com with actual values.

Review required: confirm retry behavior on your specific cPanel version before relying on undocumented retry limits.