How to Fix AutoSSL Not Working in cPanel
AutoSSL in cPanel is designed to automate SSL certificate issuance and renewal through providers like Sectigo or Let’s Encrypt.
When it stops working, websites can show certificate warnings, validation can fail, and domain security can be disrupted until the underlying issue is resolved.
This guide explains the most common causes of AutoSSL failures and how to troubleshoot them step by step, including DNS misconfiguration, server readiness, account permissions, and validation errors that are easy to miss.
What AutoSSL Does in cPanel
AutoSSL is a cPanel and WHM feature that automatically requests, installs, and renews SSL/TLS certificates for domains hosted on your server.
It checks domain ownership, validates the domain through HTTP or DNS methods, and then deploys certificates to protect HTTPS traffic.
On a healthy server, AutoSSL reduces manual certificate work and prevents expiration gaps.
When it fails, the problem is usually not the certificate itself but one of the dependencies AutoSSL relies on to complete validation.
Common Reasons AutoSSL Stops Working
- DNS records point to the wrong server, preventing validation from reaching the correct host.
- Apache or NGINX proxy issues block the validation path used by the certificate authority.
- Firewall or security tools such as ModSecurity or CSF interfere with HTTP validation requests.
- Invalid domain ownership data in cPanel or WHM prevents certificate issuance.
- CAA records restrict which certificate authorities are allowed to issue certificates for the domain.
- Expired, parked, or redirected domains fail domain checks during AutoSSL runs.
- Permission or filesystem issues prevent cPanel from writing certificate files.
- CA rate limits or service outages temporarily interrupt issuance.
Check Whether AutoSSL Is Enabled
Start by confirming that AutoSSL is actually enabled in WHM for the server or account.
In WHM, go to the AutoSSL interface and verify that a provider is selected and active for the account or reseller level you are managing.
If you are using cPanel without WHM access, ask the hosting provider whether AutoSSL is enabled on the server and whether your account is included in the policy scope.
Some shared hosting environments restrict AutoSSL control to the provider.
Verify Domain Ownership and DNS Resolution
AutoSSL can only issue certificates for domains that resolve correctly to the server.
If a domain’s A record or AAAA record points elsewhere, validation may fail even if the website appears to load through cached DNS.
Check the following:
- The domain’s A record points to the server’s public IPv4 address.
- The AAAA record is correct if IPv6 is enabled, or removed if unused.
- Nameservers are consistent with the current hosting setup.
- The domain is not still propagating after a recent DNS change.
If you recently migrated from one host to another, wait for DNS propagation and test from multiple networks before re-running AutoSSL.
Review CAA Records
CAA records tell certificate authorities which issuer is allowed to create certificates for your domain.
If your domain has a restrictive CAA record that does not include the AutoSSL provider, issuance will fail.
For example, if the domain allows only one CA and AutoSSL tries to use another, the validation process may succeed but certificate issuance will be denied.
Check your DNS zone for CAA records and confirm they authorize the correct issuer used by your server.
If you do not intentionally use CAA restrictions, removing an unnecessary CAA record often resolves the issue.
Inspect the AutoSSL Error Log
The most reliable way to fix AutoSSL not working in cPanel is to read the actual error output.
In WHM, the AutoSSL interface usually provides logs or recent run results that explain why a domain failed.
Look for messages such as:
- “DCV validation error”
- “Domain resolves to an IP address not managed by this server”
- “CAA record forbids issuance”
- “HTTP DCV lookup failed”
- “The system failed to write the certificate”
Each message points to a different layer of the issue, so avoid guessing.
The error text often tells you whether the problem is DNS, permissions, reachability, or policy-related.
Confirm the Validation Path Is Reachable
AutoSSL typically performs domain control validation using HTTP on port 80.
If port 80 is blocked, redirected incorrectly, or intercepted by security software, the validation request may never reach the expected file or token path.
Check for these blockers:
- Firewalls blocking inbound port 80.
- Reverse proxies or CDN configurations that interfere with the challenge path.
- .htaccess rules forcing unusual redirects.
- Maintenance mode plugins or application firewalls.
If the site uses Cloudflare or another CDN, ensure the domain is not set to block direct origin validation.
Temporary DNS-only or gray-cloud settings can help isolate the issue during troubleshooting.
Check File and Directory Permissions
cPanel must be able to write certificate files and validation data in the appropriate directories.
Incorrect ownership or restrictive permissions can stop the certificate installation even when validation succeeds.
Common indicators include certificate generation succeeding but installation failing, or repeated retries without a clear DNS error.
Make sure the account’s home directory, the web root, and related SSL paths are writable by the system processes that cPanel uses.
If you are on a managed server, avoid changing filesystem permissions manually unless you know the hosting stack.
A full file permission audit is safer than loosening permissions broadly.
Look for Conflicts with Existing SSL Configuration
Older or manually installed certificates can sometimes conflict with AutoSSL deployment.
This is more likely when the site uses custom virtual host templates, third-party control panel plugins, or a prior certificate installation that was not fully removed.
Useful checks include:
- Whether the domain already has a different certificate assigned.
- Whether the Apache virtual host configuration was customized.
- Whether the certificate chain is incomplete or outdated.
- Whether the server is running a supported version of cPanel and its web server stack.
If the certificate installs but browsers still show warnings, the problem may be a mixed-content issue, an old cached certificate, or a site alias using a different document root.
Test WHM and cPanel Service Health
AutoSSL depends on several services, including DNS resolution, web server availability, and internal cPanel processes.
If the server is under heavy load or a related service is down, the AutoSSL task can fail intermittently.
Check that the following are healthy:
- cPanel service processes
- Apache or LiteSpeed web server
- DNS service such as BIND or PowerDNS
- Firewall rules and security daemon status
Also review disk space.
Low disk space can prevent logs, temporary files, and certificate artifacts from being created properly.
Re-run AutoSSL After Fixing the Root Cause
Once the underlying issue is corrected, re-run AutoSSL from WHM and review the results again.
If multiple domains are on the same account, the fix may only affect one hostname at first, especially if subdomains or aliases had different DNS records.
For best results, validate these domains individually:
- Main domain
- www subdomain
- Mail-related hostnames if used
- Parked or addon domains
After issuance, visit the site in a browser and confirm the certificate chain, hostname match, and expiration date.
Prevent Future AutoSSL Failures
After you solve the immediate problem, a few preventive practices can reduce future outages.
Keep DNS consistent, avoid unnecessary CAA restrictions, and review changes to firewalls, CDN settings, or rewrite rules before they affect validation.
It also helps to monitor certificate status proactively in WHM so failures are detected before expiration.
For managed hosting environments, document any custom web server, proxy, or DNS changes so AutoSSL troubleshooting is faster the next time a renewal problem appears.
- Keep A and AAAA records aligned with the active server.
- Allow ports 80 and 443 for validation and HTTPS traffic.
- Review CAA records before adding strict issuance rules.
- Check AutoSSL logs after migrations or DNS changes.
- Maintain current cPanel and web server updates.
When to Contact Your Host or Server Administrator
If you have confirmed DNS, permissions, CAA records, and validation reachability but AutoSSL still fails, the issue may be server-level.
Hosts can inspect WHM logs, certificate authority responses, and service configuration more deeply than a site owner can from cPanel alone.
Share the exact AutoSSL error messages, the affected domains, recent DNS changes, and any firewall or CDN details.
Precise symptoms usually lead to a faster fix than a general “SSL is broken” report.