Plesk Obsidian Technical Guide

Plesk Let’s Encrypt Certificate Not Renewing: All Errors and Solutions

Plesk SSL! and Let’s Encrypt operations verify the domain control using ACME validation. Incorrect A/A AAAA record, missing _acme-challenge TXT, external DNS, CAA restriction, port 80 block, or pending wildcard operation can prevent the certificate from being issued and automatically renewed.

Let’s EncryptSSL It!_acme-challengeWildcard SSLDNS-01 / HTTP-01

Quick Diagnosis Expert Support

root@server:~SSH

Domain validation failed
Incorrect TXT record found at _acme-challenge.example.com
DNS problem: NXDOMAIN looking up TXT
DNS problem: SERVFAIL looking up TXT
Invalid response from http://example.com/.well-known/acme-challenge/

DNS verificationA, AAAA, TXT, and CAA records

HTTP verificationPort 80 and .well-known path

WildcardDNS-01 and external DNS management

YenilemeSSL It! task and certificate assignment

Technical description

How Does Plesk Let’s Encrypt Verification Work?

The certificate authority checks that you are managing the domain with HTTP-01 or DNS-01 validation. While HTTP paths are available in normal certificates, wildcard certificates usually require the _acme-challenge TXT record.

In HTTP-01 verification, the domain's A/AAAA record should be correctly pointed to the Plesk server, and the challenge file should be accessible over the internet via port 80.

In DNS-01 validation, the new TXT value displayed by Plesk must be published on the authorized nameserver. If the old TXT value remains, an Incorrect TXT record error may occur.

If DNS is managed by another provider, Plesk adding a record to the local DNS zone alone is not sufficient. The record must be entered in the actual authorized DNS panel.

Even if a certificate is obtained, if it has not been assigned to web, mail, webmail, or panel service, the user can still view the old certificate.

Wildcard TXT value may change with each renewal. If the external DNS provider is not automatically integrated with Plesk, automatic renewal may require manual TXT update.

Log messages and their meanings

Plesk SSL and ACME error messages

Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.

8 registration

01kritik

Incorrect TXT record found at _acme-challenge

Meaning: ACME server saw different value instead of expected TXT.

Possible cause: Old TXT record, wrong DNS panel, or incomplete deployment.

Identify authorized name servers and compare all TXT responses with dig.

02kritik

NXDOMAIN looking up TXT

Meaning: _acme-challenge name could not be found on DNS.

Possible cause: The TXT record has not been added or entered into the wrong host field.

Add the correct name and value to the authorized DNS provider.

03kritik

SERVFAIL looking up TXT

Meaning: Authorized DNS server failed to produce a valid response.

Possible cause: DNSSEC corruption, nameserver issue or DNS service error

Verify the SOA/NS and DNSSEC chain.

04kritik

Invalid response from /.well-known/acme-challenge

Meaning: The HTTP challenge URL has not returned the expected token.

Possible cause: Incorrect A/AAAA, port 80 block, redirect, proxy, or application rule.

Test challenge path from outside network with curl.

05warning

CAA record forbids issuance

Meaning: The CAA record is not allowing Let's Encrypt to issue certificates.

Possible cause: Incorrect or restrictive issue/issuewild record.

Review CAA records and add permissions according to company policy.

06warning

Too many failed authorizations / rate limit

Meaning: Let’s Encrypt has detected a large number of failed attempts in a short period of time.

Possible cause: Certificate requests were sent repeatedly before the issue was resolved.

First, verify DNS/HTTP validation using staging or manual tools and wait for the timeout period.

07kritik

Certificate renewal failed

Meaning: The automatic renewal task for the current certificate has not been completed.

Possible cause: DNS change, external DNS, task failure or domain scope change.

Check the history and the renewal message in the panel.log.

08warning

Certificate was issued but the browser is still showing the old certificate

Meaning: The new certificate has not been assigned to the correct service or the proxy cache is serving an old certificate.

Possible cause: Domain hosting setting, mail/panel certificate, or CDN edge certificate.

Directly check the origin and public endpoint certificates with openssl.

No records matching this expression were found.

Secure first review

SSH diagnostic commands and what output to look for?

Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.

A and AAAA records

dig +short A example.com
dig +short AAAA example.com
dig +trace example.com | tail -n 30

Shows which server the domain name and IPv6 record point to.

Authorized NS and SOA

dig +short NS example.com
dig SOA example.com +noall +answer

Determines which DNS provider the change should be made to.

ACME TXT check

dig TXT _acme-challenge.example.com +noall +answer

Lists TXT values visible in the external world.

HTTP challenge test

curl -vI http://example.com/.well-known/acme-challenge/eka-test

Port 80 shows external access to the redirect and challenge path.

Sunulan sertifika

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Shows the certificate names and dates actually provided by the server.

Plesk SSL logs

grep -Ei 'letsencrypt|acme|certificate|sslIt' /var/log/plesk/panel.log | tail -n 120

Plesk panel certificate operations show error details.

Web Certificate Configuration

plesk repair web example.com

Domain web configuration and SSL assignments check on the Plesk side

Safe solution order

Properly resolve the Plesk Let’s Encrypt renewal error

Specify the certificate type, verify the authorized DNS, test the challenge path, and only request again after the issue has been resolved.

Determine whether it's normal or wildcard.

Wildcard certificates require DNS-01 TXT verification. If a normal certificate can be obtained via HTTP-01, the process is different.

Find the authorized DNS provider.

NS records should be set up in the DNS panel outside of Plesk if the Plesk server is not being displayed.

dig +short NS example.com

Validate A, AAAA, TXT, and CAA records

Incorrect IPv6 record, may break old TXT or restrictive CAA certificate process.

Test the HTTP challenge path externally

Port 80 and the .well-known path should not be blocked by a proxy, redirect, or security rule.

curl -v http://example.com/.well-known/acme-challenge/eka-test

Try again after DNS propagation is complete

Do not send Continue/Reload or new request without being visible in all authorized resolvers.

Verify that the new certificate has been assigned to services.

Certificate assignments for the website, webmail, mail, and panel can be separate. Check the public endpoint using openssl.

Distinction by symptom

Special scenarios and decision trees

Cloudflare proxy is being used

Redirects and WAF rules are checked during the HTTP challenge. The Origin A/AAAA record must be correct; a real DNS TXT record is required for wildcard.

Wildcard automatic renewal is not enabled

DNS Plesk outside and API integration may require manual updating of the new TXT value.

Web SSL is correct, mail certificate is wrong.

Mail server and webmail certificate assignments are also checked in the Tools & Settings section.

AAAA going to wrong server

Let’s Encrypt can reach the wrong origin over IPv6. Unused AAAA records must be removed or pointed to the correct IP.

DNSSEC after SERVFAIL

The registrar DS record is checked for key matching with the DNS provider; a certificate is not requested before resolving the broken chain.

Absolutely don't

Do not send repeated certificate requests consecutively and create a rate limit before the issue is resolved.
Do not delete old TXT records without understanding their purpose.
DNS Plesk is managed outside, only Plesk DNS screen should be edited.
Block port 80 permanently with the firewall and do not wait for HTTP-01 renewal.
Do not share certificate key files via email or support message.
Do not stop monitoring the expiration date, assuming the Wildcard certificate is automatically renewed.

Post-solution verification

A and AAAA records (if present) are going to the correct origin server.
_acme-challenge TXT shows the expected value on all authoritative DNS.
CAA allows Let’s Encrypt usage.
The HTTP challenge path can access the expected token instead of 403/404.
The provided certificate includes the correct SAN names and the new expiration date.
SSL It! automatic renewal task is not producing errors.

Official technical resources

cPanel and manufacturer documentation

Plesk: Incorrect TXT recordOfficial fix for ACME TXT validation error

Plesk: NXDOMAIN _acme-challengeActions to take when a Wildcard TXT record is not found

Plesk: DNS query timed outDNS timeout in secondary verification

Internal SEO content set

Plesk Let’s Encrypt Error Curiosities about

Why does Plesk SSL not automatically renew?

The DNS or challenge conditions may have changed after the initial setup. A common reason is that the wildcard TXT value in the external DNS cannot be updated automatically.

What does an incorrect TXT record mean?

Let’s Encrypt is seeing a different or old TXT value instead of the expected new token.

Why is a TXT record required for Wildcard SSL?

Since it is not possible to individually verify all subdomains under the Wildcard scope via HTTP, domain verification is proven using the DNS-01 method.

Is Cloudflare SSL the same as Let’s Encrypt?

No. Cloudflare edge certificate is between Cloudflare and visitor; origin Plesk server's certificate should also be managed.

Does the AAAA record affect the SSL process?

Yes. If the domain is going to a wrong server with IPv6, the verification may fail from that endpoint.

Why is the old certificate still being shown even though the certificate was issued?

The new certificate may not be assigned to the relevant domain or service, or the CDN/proxy may be displaying its own certificate.

Is CAA record necessary?

Not required; but if present, only allowed certificate authorities can issue certificates. Incorrect CAA prevents issuance.

EKA SOFTWARE AND INFORMATION SYSTEMS

Let's fix the error on your server permanently

By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.

Get Server Support WhatsApp

Custom Server Services

Standard Servers