cPanel Problems
cPanel AutoSSL Failed
Last reviewed
Direct answer
When cPanel’s AutoSSL fails to issue or renew a certificate, the domain usually still has DNS pointed away from the server (often through a proxy like Cloudflare), a Domain Control Validation (DCV) check that could not reach the site over plain HTTP, a full disk quota blocking the validation file from being written, or a CAA DNS record that blocks the certificate authority. Check the AutoSSL log in cPanel for the specific failure reason first, then fix DNS/proxy, DCV, quota, or CAA depending on what it reports rather than guessing.
AutoSSL renews free certificates automatically, but the renewal has to prove domain ownership over plain HTTP and write files to disk to do it — so proxies, firewalls, DNS mismatches, and full disk quotas can silently block it until the old certificate expires and visitors see a security warning. This guide covers reading the AutoSSL log, fixing DCV and DNS issues, handling Cloudflare-proxied domains, and clearing quota problems that block renewal.
Key facts
Verifiable numbers and definitions — each claim links to its source.
- cPanel's SSL/TLS Status interface shows AutoSSL certificate status and history for each domain on the account. (cPanel SSL/TLS Status)
- WHM Manage AutoSSL documents how providers configure the AutoSSL provider, include/exclude lists, and run checks for accounts. (WHM Manage AutoSSL)
- cPanel Support documents that an exceeded disk quota can cause AutoSSL HTTP domain-control validation (DCV) to fail. (AutoSSL DCV disk quota failure)
What the error means
AutoSSL issues certificates through Domain Control Validation (DCV): the certificate authority makes an HTTP request to a special validation path on your domain (or checks DNS, depending on method) to confirm you control it, then cPanel writes the resulting certificate to disk and installs it. Every step can fail independently — DNS pointing to a different server or a CDN/proxy that intercepts the validation request, a firewall or security plugin blocking the validation path, a CAA DNS record that restricts which certificate authorities are allowed to issue for the domain, or a disk quota so full that cPanel cannot even write the validation or certificate files. Because the old certificate keeps working until it actually expires, a failed AutoSSL renewal is often invisible until visitors suddenly see “Not Secure” or a certificate-expired warning.
Common symptoms
- AutoSSL failure notification email from cPanel or your host
- SSL/TLS Status in cPanel shows a failed or pending AutoSSL run for the domain
- Browser shows “Not Secure”, a certificate expired warning, or a hostname mismatch once the old cert lapses
- Certificate covers www but not the bare domain, or vice versa (partial DCV failure)
- AutoSSL log references a DCV failure, timeout, or unexpected response for the domain
- Renewal fails specifically on domains proxied through Cloudflare or another CDN while direct-to-server domains renew fine
- AutoSSL log mentions disk quota or a write failure rather than a validation failure
Most likely causes
- 01 Domain’s DNS points to a proxy or CDN (Cloudflare orange-cloud, etc.) that intercepts the DCV request before it reaches the actual server
- 02 A/AAAA or CNAME records for the domain or a subdomain point to the wrong server entirely
- 03 A CAA DNS record on the domain that does not authorize the certificate authority cPanel’s AutoSSL uses
- 04 Firewall, security plugin, or `.htaccess` rule blocking the `.well-known` validation path or port 80 traffic
- 05 Disk quota exceeded on the account, preventing AutoSSL from writing validation or certificate files
- 06 Domain recently moved between servers/hosts and DNS has not fully propagated everywhere
- 07 Rate limiting from the certificate authority after too many recent failed or duplicate requests for the same domain
What changed before the problem started
- Domain was added to Cloudflare or another CDN/proxy, or its proxy status toggled on
- DNS records or nameservers were changed during a migration
- A CAA record was added for security hardening without including the certificate authority AutoSSL uses
- Account disk usage grew close to or past quota
- A new firewall rule, security plugin, or `.htaccess` change started blocking plain-HTTP requests
Troubleshooting steps
- 01
Read the actual AutoSSL failure reason in cPanel first
Open cPanel’s SSL/TLS Status page and view the AutoSSL log/history for the domain. It reports a specific reason (DCV failure, disk quota, rate limit, CAA issue) rather than a generic error — fixing the right thing the first time saves several failed retry cycles, since AutoSSL only runs periodically.
- 02
Confirm DNS points directly at your hosting server’s IP
Check the domain’s A/AAAA records against the IP address your host gives you. If using Cloudflare, temporarily set the record to “DNS only” (gray cloud) so the validation request reaches your server directly, run AutoSSL again, then re-enable the proxy afterward once the certificate issues successfully.
- 03
Check for a blocking CAA record
Look up the domain’s CAA record (many DNS providers or online lookup tools show this). If one exists and does not include the certificate authority your host’s AutoSSL uses, either remove the restrictive CAA record or add an entry authorizing that authority, then retry.
- 04
Verify the site responds over plain HTTP on port 80
DCV typically needs a plain-HTTP response, not just HTTPS. Confirm nothing (firewall, force-HTTPS redirect rule, security plugin) is blocking or hard-redirecting port 80 requests to the `.well-known` validation path before HTTPS is even established.
- 05
Clear disk quota if the log mentions a write failure
If AutoSSL’s log references quota or a failed file write, resolve the account’s disk/inode usage (see the disk quota guide) before retrying — AutoSSL cannot write validation files or the finished certificate when the account has no space left.
- 06
Manually trigger AutoSSL again after fixing the root cause
Once DNS, CAA, port-80 access, or quota is corrected, run AutoSSL manually from cPanel’s SSL/TLS Status page rather than waiting for the next automatic cycle, and confirm the new certificate’s expiration date updates.
When to stop troubleshooting
Stop retrying blindly once you have read the actual AutoSSL log reason — repeated failed attempts for the same unresolved cause can trigger certificate-authority rate limits that make things worse. If DNS/CAA/quota all check out and AutoSSL still fails, if the domain is on a server you do not control (reseller or managed hosting), or if a proxy/CDN configuration is business-critical and cannot be toggled without approval, hand off to your host or a technician with the AutoSSL log in hand.
Information to collect before requesting help
- 01 Exact AutoSSL failure reason from cPanel’s SSL/TLS Status log
- 02 Whether the domain is proxied through Cloudflare or another CDN
- 03 Current A/AAAA record values and the host’s expected server IP
- 04 Whether a CAA DNS record exists for the domain
- 05 Current disk/inode usage percentage on the account
- 06 Whether the domain recently moved hosts or had DNS changes
- 07 Screenshot of the browser’s certificate warning, including the certificate’s listed expiration and issuer
How a professional repairs the problem
A technician pulls the exact AutoSSL log entry to identify DCV, CAA, quota, or rate-limit failure precisely, verifies DNS resolution and proxy configuration across resolvers, temporarily adjusts proxy/CAA settings only as needed to let validation succeed, clears any quota blocking file writes, and confirms the reissued certificate’s expiration and issuer before restoring the original DNS/proxy configuration.
Frequently asked questions
Why does my SSL certificate expire if AutoSSL is supposed to be automatic? +
Does Cloudflare cause AutoSSL to fail? +
What is a CAA record and why would it block my certificate? +
Can a full disk quota really block SSL renewal? +
Is it safe to toggle Cloudflare’s proxy off temporarily? +
How do I know if the fix actually worked? +
Repair dispatch
Still Need Help Fixing Your Website?
If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.
- You will receive a clear explanation of the likely cause.
- We will tell you if the issue falls outside our repair scope.
- No additional work will be performed without approval.
- A backup should be created whenever access and website condition allow it.
Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.