SSL certificate expiry warnings cPanel users encounter almost always trace back to the same quiet culprit, AutoSSL failing to renew a Let’s Encrypt certificate weeks before anyone actually notices. I remember getting a nasty surprise one morning when a client’s site suddenly showed a browser warning about an insecure connection. The certificate had technically been failing to renew for nearly a month before it finally expired and became visible.
That delay is the part most people do not realize. AutoSSL attempts renewal roughly thirty days before expiry, and if that attempt fails, it quietly keeps retrying in the background without anyone noticing until the old certificate finally runs out. Below, I will walk you through exactly why these renewal failures happen and how to fix them step by step inside cPanel and WHM.
Why Let’s Encrypt Auto-Renewal Fails in cPanel
AutoSSL failures almost always come down to one of three root causes, even though the error messages themselves can look very different from each other.
- DNS pointing somewhere unexpected. If a domain or subdomain no longer resolves to the correct server, Let’s Encrypt cannot verify ownership.
- Domain control validation failures. The verification file Let’s Encrypt needs to check has to be reachable over plain HTTP, and anything blocking that will break renewal.
- A proxy, CDN, or firewall interfering with the request. Services like Cloudflare or a strict WAF can sometimes modify or block the validation request in a way Let’s Encrypt rejects.
Step-by-Step: How to Fix SSL Certificate Expiry Warnings in cPanel
Work through these steps in order, since the first few resolve the vast majority of AutoSSL failures.
Step 1: Check the SSL/TLS Status in cPanel
Log into cPanel and go to Security, then SSL/TLS Status. This page lists every domain on the account along with whether AutoSSL last ran successfully. Look for any domain showing a red or yellow status, or an expiry date that has already passed.
Step 2: Run AutoSSL Manually and Read the Log
From the same SSL/TLS Status page, click Run AutoSSL at the top. This forces an immediate renewal attempt instead of waiting for the next scheduled run. Watch the log output carefully, since a failed attempt will show the exact error message you need for the next steps.
Step 3: Pull the Detailed AutoSSL Logs
If you have WHM access, you can check more detailed logs directly on the server for a clearer picture of what went wrong:
# View the AutoSSL log for a specific user
cat /var/cpanel/logs/autossl/username.log
# Check the global AutoSSL log
cat /var/log/autossl.log
# Tail the log in real time during a manual run
tail -f /var/log/autossl.logStep 4: Confirm DNS Is Pointing to the Correct Server
You should verify that the domain and any relevant subdomains actually resolve to your server’s IP address. If a subdomain has no valid DNS entry, or points somewhere else entirely, AutoSSL cannot complete validation for it and this alone can block renewal for the whole certificate.
Step 5: Check That the ACME Challenge Path Is Reachable
Let’s Encrypt validates domain ownership through a file placed inside a .well-known/acme-challenge directory, accessed over plain HTTP. You should confirm this directory exists, is readable by your web server, and is not being blocked or redirected.
A common cause is a forced HTTPS redirect rule catching the validation request before it can complete. Adding this rule to your .htaccess file ensures the challenge path is never redirected:
RewriteEngine On
RewriteRule ^\.well-known/acme-challenge - [L]Step 6: Review Any Proxy, CDN, or Firewall Settings
If your domain sits behind Cloudflare or a similar service, temporarily pause proxying or switch the relevant DNS record to “DNS only” mode while AutoSSL runs. You should also check whether a web application firewall is blocking requests to the validation path, since strict WAF rules are a common hidden cause of renewal failures.
Step 7: Remove Problem Subdomains From the Certificate
If specific subdomains are consistently failing validation and you do not actually need SSL coverage for them, you can remove them from the AutoSSL configuration for that domain rather than letting them block renewal for everything else.
Step 8: Delete and Reissue the Certificate as a Last Resort
If the certificate remains stuck after the steps above, you can remove the existing expired or broken certificate from cPanel’s SSL/TLS menu entirely, then trigger a fresh AutoSSL run or use the SSL/TLS Wizard to reissue a new one from scratch.
For Server Administrators Managing WHM
If you manage the server itself rather than a single hosting account, a few additional checks are worth confirming.
- Configure AutoSSL settings under WHM Home, then SSL/TLS, then Manage AutoSSL, to confirm Let’s Encrypt is selected as the active provider.
- Watch for Let’s Encrypt rate limits, since exceeding fifty certificates per domain per week will cause renewal attempts to fail temporarily.
- Confirm the domain does not already have a certificate that is still within its renewal window, since AutoSSL will skip domains it believes are already covered.
- Check server time synchronization, since a server clock that has drifted can occasionally interfere with certificate validation.
How to Prevent This From Happening Again
A little monitoring goes a long way toward catching renewal problems before they turn into a visible outage.
- Set up expiry monitoring through a tool like SSL Labs or UptimeRobot, which can alert you fourteen to thirty days before a certificate actually expires.
- Check cPanel’s SSL/TLS Status page periodically rather than assuming AutoSSL is always working silently in the background.
- Avoid changing your document root or DNS settings without checking whether your existing AutoSSL configuration references the old paths or records.
- Read AutoSSL failure emails immediately instead of dismissing them, since they usually arrive with weeks of runway before the certificate actually expires.
- Keep proxy and firewall rules documented so you can quickly pause or adjust them if they start interfering with future renewal attempts.
What Actually Worked For Me
When I dealt with this on a client site, the AutoSSL log pointed straight to a failed domain control validation on one specific subdomain. That subdomain’s DNS record had quietly stopped pointing at the right server months earlier, long before anyone noticed.
You should always start by reading the actual log message rather than guessing. In my experience, the fix is almost always one of a small handful of causes, and the log will usually tell you exactly which one you are dealing with rather than leaving you to guess randomly.
FAQ
1. Why does AutoSSL fail silently before a certificate actually expires? AutoSSL typically attempts renewal around thirty days before expiry, and if that attempt fails, it retries quietly in the background without any visible warning until the certificate finally runs out.
2. What is the most common cause of Let’s Encrypt renewal failures in cPanel? Domain control validation failures are the most common cause, often triggered by DNS pointing to the wrong server or something blocking access to the ACME challenge path.
3. Can Cloudflare cause AutoSSL renewal to fail? Yes, proxying through Cloudflare or a similar service can sometimes interfere with the validation request, which is why temporarily switching to DNS-only mode during renewal often resolves the issue.
4. Is it safe to delete an expired certificate in cPanel? Yes, removing an expired or broken certificate before reissuing a new one is a standard troubleshooting step and does not affect your website’s actual content or files.
5. How often does AutoSSL attempt to renew certificates? AutoSSL runs on a regular scheduled interval, typically checking certificates roughly every twelve hours, and begins attempting renewal well before the actual expiry date.
6. Does exceeding Let’s Encrypt’s rate limit cause renewal failures? Yes, Let’s Encrypt allows a limited number of certificates per domain each week, and exceeding that limit will cause renewal attempts to fail until the limit resets.
7. Can a WordPress plugin help with AutoSSL or ACME challenge issues? Yes, plugins like Really Simple SSL include built-in handling for ACME challenge routing, which can help resolve conflicts caused by forced HTTPS redirects on WordPress sites specifically.
8. Should I contact my hosting provider if AutoSSL keeps failing? Yes, if you have exhausted the steps available to you and the certificate still will not renew, your hosting provider can check server-level logs and settings that may not be visible from a standard cPanel account.
Editor’s Opinion
The scary part about this issue isnt even the fix, its how quietly it happens in the background for weeks before anyone notices. I always tell people to actualy read the AutoSSL failure emails instead of ignoring them like junk mail, becouse by the time the warning shows up in the browser its already been broken for a while. Once you check the log its usualy pretty obvious what went wrong, DNS or that acme challenge folder being blocked seem to be the biggest offenders in my experiance. Dont ignore those emails, seriously.
