Fix WHM AutoSSL failures — a decision tree

WHM's AutoSSL feature breaks in five distinct ways and the error message in the dashboard is usually the last failure in a chain, not the root cause. Read the per-domain log under SSL/TLS → Manage AutoSSL → Logs, find the first [ERROR] or Domain Control Validation Failed line, then match it against this decision tree.

1. "DNS DCV: No DNS record found"

The domain has no A or AAAA record pointing to this server, or it points elsewhere and the DNS DCV record isn't published.

Fix:

# Verify what cPanel thinks the domain resolves to
whmapi1 fetchdcvpassthroughdomains user=USERNAME

# Check actual DNS from outside the server
dig +short example.com A

If DNS doesn't point here, AutoSSL cannot succeed regardless of what else you do. Tell the customer to update DNS, or use the DNS-based DCV documentation to publish a TXT record on the existing DNS provider.

2. "HTTP DCV: 403 Forbidden" or "404 Not Found"

The Let's Encrypt validator can reach the server but can't read the challenge file under /.well-known/acme-challenge/. This is almost always a .htaccess redirect or a misconfigured WordPress security plugin.

Fix:

# Verify the .well-known path is reachable
curl -I http://example.com/.well-known/acme-challenge/test

# Look for offending .htaccess rules
grep -r "well-known" /home/USERNAME/public_html/.htaccess

The fix is usually to add an early-exit rule to the customer's .htaccess:

RewriteEngine On
RewriteRule ^\.well-known/acme-challenge/ - [L]

Place it before any force-https or WordPress rewrite blocks. If the site uses Cloudflare in proxy mode, also set Cloudflare's SSL mode to Full (strict) and disable "Always Use HTTPS" during AutoSSL runs — the redirect-to-HTTPS confuses the HTTP-01 validator.

3. "CAA record forbids issuance"

The domain has a CAA DNS record that doesn't allow Let's Encrypt (letsencrypt.org) or cPanel's other issuer (sectigo.com) to issue certificates.

Fix:

dig +short example.com CAA

If the output lists a different CA (globalsign.com, digicert.com), the domain owner needs to add a CAA record permitting the AutoSSL issuer:

example.com.  IN  CAA  0 issue "letsencrypt.org"
example.com.  IN  CAA  0 issue "sectigo.com"

CAA records are infrequent on shared hosting but common on enterprise domains being moved over from a managed-DNS service. Allow 24 hours for the new CAA to propagate before retrying.

4. "Rate limit exceeded"

Let's Encrypt rate-limits at 50 certificates per registered domain per week, and 5 duplicate certificates per week. You hit this most often when:

• A customer site has flaky DNS and AutoSSL keeps retrying.
• You just migrated 100 accounts and re-issued every cert in a single run.
• Someone's running multiple AutoSSL runs in parallel from cron.

Fix: Stop the bleeding first:

# Pause AutoSSL for a week
whmapi1 disable_autossl_for_user user=USERNAME

# Check what got issued recently
crt.sh search for "example.com" in a browser

If you're rate-limited on a single domain, switch that domain to cPanel's secondary issuer (Sectigo) under SSL/TLS → Manage AutoSSL → Providers. If you're rate-limited on a registered parent domain that affects many subdomains, you have to wait — Let's Encrypt does not lift rate limits on request.

5. "Domain DCV passthrough redirected externally"

The domain redirects to a different domain (HTTP 301 to www.example.com from example.com, or to a completely different brand). AutoSSL follows up to 4 redirects, and each hop must remain on a server the AutoSSL agent controls.

Fix: Enable DCV passthrough in WHM → SSL/TLS → Manage AutoSSL → Options. This tells AutoSSL to follow cross-host redirects and validate at the destination. It's off by default for safety, but is the right setting for any account that uses an apex-to-www redirect via a CDN.

Decision tree

AutoSSL failed →
├─ "No DNS record"          → fix DNS, retry
├─ "403 / 404 on .well-known" → check .htaccess, Cloudflare, WordPress security plugins
├─ "CAA record forbids"     → add CAA for letsencrypt.org / sectigo.com
├─ "Rate limit exceeded"    → wait or switch issuer
└─ "DCV passthrough"        → enable passthrough in WHM AutoSSL options

When the issuer itself is the problem

Occasionally Let's Encrypt itself has an outage or a regional ACME server is slow. Check letsencrypt.status.io before chasing the customer. If the issuer is healthy and a single user's domains all fail at the same step, the cause is local to that user — usually a WAF rule, a .htaccess misconfiguration, or a global redirect.

For SSL issues on a freshly-installed server, double-check the cPanel installation post-checks — AutoSSL needs port 80 open inbound from the public internet, which some VPS providers block by default.

Next steps

• For the related "license invalid" banner that sometimes shows up next to SSL errors, see the cPanel licence invalid checklist.
• If a recent OS migration broke SSL renewals across the board, the CentOS-to-AlmaLinux guide covers the post-migration AutoSSL re-run.
• For LiteSpeed-specific SSL handover, see LSWS install on cPanel — the cert path is shared with Apache and AutoSSL works without changes.