Turkey (Turkish)
Germany (German)
Worldwide (English)
DNS DCVA, AAAA, NS and authoritative DNS
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
If AutoSSL cannot create or renew a certificate, the problem is usually related to the domain's DNS side, A/AAAA records, CAA policy, .well-known validation path, Cloudflare proxy, or cPanel domain ownership. This guide selects the correct check based on the error message.
AutoSSL failed to secure the domain.
DNS DCV: SERVFAIL looking up A for example.com
Local HTTP DCV error: 403
The domain is unmanaged.
CAA record prevents certificate issuance.cPanel AutoSSL scans account domains and creates or renews free DV certificates for suitable domains. If the certificate authority cannot validate the domain name using the Domain Control Validation method based on DNS or HTTP, the certificate will not be issued.
During DNS DCV, the domain's A or AAAA records, nameserver response, and CAA policy are checked. SERVFAIL, timeout, or incorrect IP validation can cause it to fail immediately.
HTTP DCV requires external access to the special .well-known validation path within the domain name. 403, 404, infinite redirects, application router, or WAF rule can block the validation file.
Cloudflare orange cloud can usually work with AutoSSL; however, incorrect Origin Rule, Workers, Always Use HTTPS, Access policy or AAAA record can redirect verification to a different target.
If a domain is not correctly defined as an addon, alias, or subdomain in the cPanel account, AutoSSL may see it as unmanaged. Even if DNS is correct, account ownership and userdata records must be verified.
AutoSSL logs clearly state the reason for the error. Before re-running the certificate, prove that DNS is responding correctly from the outside world and that the HTTP validation path is accessible from the outside.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: AutoSSL was unable to complete the certificate creation or renewal process for the domain.
Possible cause: DNS/HTTP DCV, CAA, rate limit, domain ownership or connection problem
Meaning: Authorized DNS server failed to produce a valid A response.
Possible cause: Corrupted zone, DNSSEC mismatch, nameserver access or upstream DNS issue.
Meaning: The certificate validation system has not received the DNS response in time.
Possible cause: UDP/TCP 53 block, nameserver closed, firewall or network issue.
Meaning: Access to the verification URL is prohibited.
Possible cause: ModSecurity, .htaccess deny, WAF, Cloudflare Access, or file permissions.
Meaning: The verification file has not been served from the expected URL.
Possible cause: Incorrect DocumentRoot, rewrite/router, proxy, redirection, or domain pointing to another server.
Meaning: The CAA record is not allowing the certificate authority used by AutoSSL.
Possible cause: Only allow issue/issuewild records or CAA SERVFAIL for different CAs.
Meaning: cPanel does not recognize this domain as being managed by the associated account.
Possible cause: Addon domain registration is missing, userdata is corrupted, domain belongs to another account, or has been removed.
Meaning: Both HTTP and DNS verification methods have failed.
Possible cause: Domain name is pointing to the wrong server, DNS is broken or validation path is blocked.
Meaning: The renewal has been delayed because the current certificate is valid for a sufficient amount of time.
Possible cause: Normal AutoSSL behavior or protection of a certificate uploaded by the user.
Meaning: The server is providing a certificate that does not belong to the requested domain.
Possible cause: SNI/vhost match, incorrect IP, proxy, old certificate or service SSL.
Meaning: The IPv6 supported authenticator domain may try to validate on another target.
Possible cause: Old or incorrect AAAA record; new server has not been configured with IPv6.
Meaning: The certificate authority has exceeded the retry or domain set limit.
Possible cause: Frequent failed attempts, multiple identical certificates, or incorrect test process.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
/usr/local/cpanel/bin/autossl_check --user=USERNAMEInitiates AutoSSL check for a specific cPanel account and generates a result.
/usr/local/cpanel/bin/autossl_check --allScans all AutoSSL active users; use with caution on busy servers
ls -lt /var/cpanel/logs/autossl/ | head
find /var/cpanel/logs/autossl -type f -mtime -2 -print 2>/dev/null | tail -n 20Find the latest AutoSSL log entries
dig +short A ALANADI
dig +short AAAA ALANADI
dig +short NS ALANADI
dig +short CAA ALANADIQuickly shows A, IPv6, nameserver, and CAA records.
for ns in $(dig +short NS ALANADI); do echo "### $ns"; dig @$ns ALANADI A +norecurse; doneBypasses the resolver cache and compares authoritative nameserver responses.
mkdir -p /home/USERNAME/public_html/.well-known/acme-challenge
echo eka-dcv-test > /home/USERNAME/public_html/.well-known/acme-challenge/eka-test.txt
curl -IL http://ALANADI/.well-known/acme-challenge/eka-test.txtIt tests whether the verification path returns 200; delete the test file when done.
echo | openssl s_client -connect ALANADI:443 -servername ALANADI 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameDisplays the domain names and dates of the certificates offered via SNI.
/usr/local/cpanel/bin/whmapi1 get_domain_info domain=ALANADI
grep -R "^documentroot:" /var/cpanel/userdata/USERNAME/ALANADI* 2>/dev/nullVerifies which account and DocumentRoot the domain is associated with.
First, determine the validation type in the log; then verify DNS, HTTP path, CAA, account ownership, and the issued certificate separately.
General failed message instead, record the DNS DCV, HTTP DCV, CAA or rate limit reason in the relevant domain row.
find /var/cpanel/logs/autossl -type f -mtime -2 -print 2>/dev/null | tailThe domain name must point to the correct IP of this cPanel server. Old AAAA record and split nameserver delegation are checked in particular.
dig +short A ALANADI
dig +short AAAA ALANADI
dig +trace ALANADI NS | tail -n 30CAA should only specify the permitted certificate authorities. If DNSSEC is used, the registrar's DS record must be compatible with the zone signature.
dig CAA ALANADI +dnssec
dig DNSKEY ALANADI +dnssecTest file should return 200. If 403/404, .htaccess, ModSecurity, proxy, application router, and Cloudflare rules are adjusted.
curl -IL http://ALANADI/.well-known/acme-challenge/eka-test.txtThe domain must be registered in the correct cPanel account and with the correct DocumentRoot. If necessary, the userdata is recreated under expert control.
/usr/local/cpanel/bin/whmapi1 get_domain_info domain=ALANADIAfter the root cause is resolved, run AutoSSL only for the relevant user and check the SAN and expiration date of the new certificate with openssl.
/usr/local/cpanel/bin/autossl_check --user=USERNAME
echo | openssl s_client -connect ALANADI:443 -servername ALANADI 2>/dev/null | openssl x509 -noout -dates -ext subjectAltNameA/AAAA records, proxy status, Origin Rules, Workers, Access, and Redirect Rules are checked. If a temporary DNS-only test is to be performed, security and origin IP visibility should be taken into account.
dig +short A ALANADI
dig +short AAAA ALANADI
curl -IL http://ALANADI/.well-known/acme-challenge/eka-test.txtModSecurity audit log, .htaccess deny rules, and Cloudflare/WAF policy are reviewed. Instead of disabling the entire security layer, exceptions are granted for authentication only.
grep -R "ALANADI" /usr/local/apache/logs/modsec_audit.log 2>/dev/null | tail -n 40The HTTP→HTTPS and www→non-www rules may be mutually exclusive. The .well-known path should be excluded from the redirect loop.
curl -IL --max-redirs 10 http://ALANADI/.well-known/acme-challenge/eka-test.txtIPv6 validation may go to the old server. If IPv6 is not used, AAAA is removed; if used, the same vhost and validation path must work on IPv6 as well.
curl -6IL http://ALANADI/.well-known/acme-challenge/eka-test.txt
curl -4IL http://ALANADI/.well-known/acme-challenge/eka-test.txtThe Web site AutoSSL process for WHM/cPanel/Exim/Dovecot service certificates is not the same. The hostname DNS and Manage Service SSL Certificates section are checked separately.
hostname -f
dig +short A $(hostname -f)
/usr/local/cpanel/bin/checkallsslcertsThe most common causes are incorrect A/AAAA records, DNS SERVFAIL, HTTP authentication path returning 403/404, CAA restrictions, and domain not managed in cPanel, and rate limiting.
DNS DCV proves domain control via DNS records, while HTTP DCV proves domain control via access to a special validation file at the web root.
Not always. However, a wrong proxy, worker, access, redirect, or AAAA configuration can redirect the validation request to a different target or return a 403/404 response
Find .htaccess, ModSecurity, WAF, or Access Policy Blocking .well-known/acme-challenge Path and Apply Secure Exception Only to This Validation Path.
DNS record specifying which certificate authorities may issue certificates for the domain name. AutoSSL provider fails if not allowed.
Yes. If the domain has AAAA, the IPv6 target can be used for verification. If the AAAA is different or inaccessible, DCV may fail.
For a specific account, the command /usr/local/cpanel/bin/autossl_check --user=USERNAME is used. The error cause must be corrected first.
The proxy/CDN may be providing an old certificate, connecting to the wrong IP, or the web service may not have loaded the new certificate yet. SNI with openssl should be checked.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.