Turkey (Turkish)
Germany (German)
Worldwide (English)
License keycPanel license is dependent on the server's public IP
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
If WHM displays the 'No valid license exists' or license update failed warning, the license may actually be inactive or the server may be unable to access the cPanel license server via DNS/HTTPS. This guide separates the public IP, NAT, resolver, time, port 443, and license file layers.
Updating cPanel license...Done. Update Failed!
Cannot read license file
No valid cPanel & WHM license exists
DNS query failure: auth.cpanel.net A timeout
The license is not valid for this server's IP address.The cPanel & WHM license is usually assigned to the server's main visible IPv4 address on the internet. The cpkeyclt tool connects to the cPanel licensing infrastructure, verifies server information, and updates the license file.
The license may be inactive in the WHM provider panel, even though it appears active; because the server is coming out with a different public IP, the IP has changed after NAT, the license is assigned to the old IP, or the route is incorrect.
If there is a SERVFAIL or timeout in the auth.cpanel.net query, the cpkeyclt license server cannot be reached. The resolver setting, DNSSEC, firewall, or upstream DNS issue must be resolved; cPanel domain IP addresses should not be assumed to be static.
If outbound access on port 443 is blocked by a firewall, proxy, or data-center policy, the license update cannot complete. Test the curl/TLS connection separately even when DNS is correct.
If the system time is seriously incorrect, TLS certificate validation and license requests may fail. chronyd or proper NTP synchronization must be verified.
cPanel licensed servers binding IP addresses to hosts file is not a permanent solution; infrastructure addresses may change. DNS and outbound access must work properly.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: A valid and verified cPanel license cannot be found on the server.
Possible cause: License is passive, wrong IP assigned, update failed or license file cannot be read.
Meaning: cpkeyclt license renewal process has failed.
Possible cause: DNS, HTTPS, IP mismatch, time, proxy or license status
Meaning: The server cannot retrieve the DNS response for the cPanel authorization domain name.
Possible cause: Resolver access, UDP/TCP 53 firewall, upstream DNS, or DNSSEC issue.
Meaning: DNS resolver could not produce an authoritative/valid answer
Possible cause: Corrupted resolver, DNSSEC validation, network or upstream nameserver problem.
Meaning: The public IP seen by cPanel does not match the IP assigned to the license.
Possible cause: IP change, NAT, incorrect license registration, exit from additional IP, or route.
Meaning: Local license file is unreadable, it may be missing or invalid.
Possible cause: Permission, file corruption, disk/read-only issue, or failed update.
Meaning: DNS resolves but HTTPS connection cannot be established
Possible cause: Outbound 443 block, proxy, route, or remote access issue.
Meaning: TLS certificate chain could not be verified.
Possible cause: Incorrect system time, outdated CA package, MITM proxy, or DNS redirection.
Meaning: The license has expired or the account has been suspended by the license provider.
Possible cause: Payment, cancellation, provider assignment, or license plan issue.
Meaning: cPanel licensing infrastructure may have returned a temporary error or maintenance response.
Possible cause: Temporary service issue or regional network access.
Meaning: After migration, the license remains on the old server IP.
Possible cause: The new public IP is either unprocessed by the license provider or has a different NAT exit.
Meaning: The IP may have been used previously for a trial or may not meet the trial conditions.
Possible cause: Previous trial, unsuitable network/IP type or provider policy.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
/usr/local/cpanel/cpkeycltcPanel re-verifies and updates the license with server information.
/usr/local/cpanel/cpanel -V
cat /etc/redhat-release 2>/dev/null || cat /etc/os-releaseDisplays the operating system version for cPanel and support log.
curl -4s https://myip.cpanel.net/v1.0/
ip -4 route get 1.1.1.1
ip -4 addr showcPanel compares the public IP it sees with the server routes and local IPs.
dig +short A auth.cpanel.net
dig auth.cpanel.net A +trace | tail -n 40
getent ahosts auth.cpanel.netThe Resolver compares the results of trace and libc analysis.
curl -4Iv --connect-timeout 10 https://auth.cpanel.net/ 2>&1 | head -n 80Outbound 443 checks TLS handshake and certificate chain.
tail -n 200 /usr/local/cpanel/logs/license_log 2>/dev/null
grep -Ri 'license' /usr/local/cpanel/logs/error_log | tail -n 80cpkeyclt displays detailed records of cpkeyclt and cPanel license errors.
timedatectl status
chronyc tracking 2>/dev/null
chronyc sources -v 2>/dev/nullVerifies time drift and NTP synchronization.
nft list ruleset 2>/dev/null | grep -Ei 'dport (53|443)|reject|drop' | head -n 100
iptables -S OUTPUT 2>/dev/nullInvestigates local rules that block outbound DNS and HTTPS.
First, match the public IP with the IP where the license is assigned; then verify DNS, HTTPS, time, and local license updates in sequence.
Verify which IPv4 is used by cPanel to access the internet on a server with NAT or multiple IP.
curl -4s https://myip.cpanel.net/v1.0/
ip -4 route get 1.1.1.1The IP, product type, and active status in the license panel should match the real public IP. If migration has been performed, it will be reassigned to the new IP.
If auth.cpanel.net returns SERVFAIL or timeout, cpkeyclt will not succeed until the resolver and firewall issues are resolved.
dig auth.cpanel.net A
dig @1.1.1.1 auth.cpanel.net A
dig @8.8.8.8 auth.cpanel.net A443/TLS connection and correct time are verified. Certificate verification may be broken if there is an MITM proxy or an old CA package.
curl -4Iv --connect-timeout 10 https://auth.cpanel.net/
timedatectl statusAfter fixing network and license assignment, run the official license update tool as root and save the full output.
/usr/local/cpanel/cpkeycltVerify that WHM access is open, the license warning has disappeared, and there are no new errors in the license_log.
tail -n 100 /usr/local/cpanel/logs/license_log 2>/dev/null
/usr/local/cpanel/cpanel -VThe license is bound to the old IP. The new public IP is processed in the license provider panel; after DNS and NAT route validation, run cpkeyclt.
curl -4s https://myip.cpanel.net/v1.0/
ip -4 route get 1.1.1.1Local private IP and public NAT IP differ. The cPanel license must be assigned to the visible public IP and the cPanel NAT configuration must be correct.
ip -4 addr show
curl -4s https://myip.cpanel.net/v1.0/The resolver setting, DNSSEC validation, TCP/UDP 53 output, and upstream DNS are checked. Adding a fixed IP with /etc/hosts is not a long-term solution.
cat /etc/resolv.conf
dig auth.cpanel.net A +trace | tail -n 40Outbound 443 firewall, corporate proxy, provider ACL, and network route are checked. Remote access should remain open based on hostname without fixing the target IP.
curl -4Iv --connect-timeout 10 https://auth.cpanel.net/
traceroute -T -p 443 auth.cpanel.net 2>/dev/null | tail -n 20The system date, timezone, chronyd and CA trust package are checked. If the time is greatly incorrect, NTP is corrected first.
date -u
timedatectl status
rpm -q ca-certificatesThe standard cPanel & WHM license is assigned to the public IPv4 address visible to the internet on the server, not a private IP behind a NAT, but the external IP is used.
It communicates with the cPanel licensed server to verify the license status and updates the local license information.
First, the license record is compared with the public IP; then DNS, outbound 443, system time, and cpkeyclt output are checked.
The resolver issue may be caused by a UDP/TCP 53 block, upstream DNS outage, DNSSEC problem, or network/firewall rule.
Reassign the license to a new public IP, verify NAT/route and hostname DNS, and then run cpkeyclt.
The license may be assigned to a different IP or the server may not be able to access the license infrastructure via DNS/HTTPS. The local license file may also not be updated.
For DNS resolution, 53 and cPanel license infrastructure are required for HTTPS access, outbound 443 is required. Firewall and provider ACL must allow these exits.
No. Server/IP license verification is dependent and copying files from another system is not a valid solution; it may also violate security and licensing conditions.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.