When InterWorx loses contact with its licence server, NodeWorx and SiteWorx throw Invalid InterWorx-CP License and lock you out of the panel. Your sites and mail keep serving — the licensing check gates the control panel, not the services under it — and you get a 24-hour grace period before the panel suspends. That's your window to work through this list.
Nearly every case is one of four things: DNS, a blocked port, a stale IP binding, or a suspended key. Here's the fastest path through them.
Force a licence sync first
InterWorx validates against license.interworx.com on TCP 2443. Before diagnosing anything, just ask it to re-check:
~iworx/cron/license.pex --sync
If that returns cleanly, log back into NodeWorx — you're done, and the original failure was a transient network blip. If it errors, the message tells you which branch below you're in.
DNS: the server can't resolve the licence host
The most common failure, especially on fresh VPS images. Confirm resolution works at all:
ping -c2 license.interworx.com
ping -c2 google.com
If both fail, fix /etc/resolv.conf. Some providers (Vultr is the known offender) ship the file immutable, which also hangs goiworx.pex during first activation right after it writes iworx.ini:
chattr -i /etc/resolv.conf
chmod 644 /etc/resolv.conf
Add a working resolver, re-run the sync. If only the licence host fails, check for a local firewall or upstream filter eating the lookup.
Port 2443 blocked or a firewalled licence server
The XMLRPC handshake runs over 2443, and the classic symptom is:
XMLRPC error encountered Code: 2 Error: Invalid return payload:
enable debugging to examine incoming payload (XML error at line 1, check URL)
Open outbound 2443 in your firewall, and whitelist the licence server IP 207.32.181.150 if you run default-deny rules. Servers on NAT or a non-public IP fail here too — the licence is validated against the public address, so the panel host needs a routable IP.
IP changed without rebinding the licence
InterWorx keys are IP-locked. After a migration or a provider-side IP reassignment, the sync fails until the binding matches. For licences bought from us, sign in and rebind the IP on the licence row (or contact us and we'll reset it), then run license.pex --sync again.
Swapping to a different key entirely — say, moving from a trial to a paid InterWorx licence — takes one edit and a sync. The key lives in /home/interworx/iworx.ini under [iworx.license]:
vim /home/interworx/iworx.ini # set key="YOUR_NEW_KEY"
~iworx/cron/license.pex --sync
If the sync reports the key has already been activated on a different IP, that's the binding again — reset it in the portal first.
Clock skew and file permissions
Two quieter causes worth checking if everything above passes:
date # wrong clock breaks the TLS handshake
ls -la /home/interworx/.license # must be iworx:iworx 0600
Fix the clock with chronyd/NTP and correct the permissions with chown iworx:iworx /home/interworx/.license && chmod 600 on the same path. A stale GPG lock in ~iworx/etc/gpg/ (look for pubring.kbx locks) can also block the sync — clear the lock file and retry.
If none of this lands, the key itself is expired or suspended — check billing before you check the server again. See checking licence status from the command line for the equivalent one-liners across every panel we sell.
Does an invalid InterWorx license take my websites down?+
How do I force InterWorx to re-check its license?+
Where is the InterWorx license key stored?+
What ports does InterWorx licensing need?+
Why does InterWorx say my key is already activated on a different IP?+
Next steps
- Moving off cPanel? Follow the cPanel to InterWorx migration guide.
- Weigh the panels first with InterWorx vs cPanel.
- Need a key today? Order an InterWorx licence or contact sales.