Reading AutoSSL logs for a domain-validation failure

Collect the account username, affected hostname and expiry date. Check whether the hostname is intended to point to this server and whether a CDN or external DNS provider is involved.

1. Open Manage AutoSSL > Logs and select the relevant recent run. Filter or locate the affected account.
2. Read the specific validation failure and distinguish an apex name from www, mail or another subdomain on the same certificate request.
3. Compare authoritative A/AAAA and CAA records with the intended service. Remove obsolete records only after confirming they are no longer needed.
4. For HTTP validation, inspect redirects, authentication, proxy and firewall behaviour on the required validation path. For DNS validation, confirm the provider can make or verify the required records.
5. Correct the identified issue, run an appropriate targeted check and read the new result. Confirm the installed certificate’s actual names and expiry.

The required hostname should pass validation and appear on the resulting certificate. A certificate that succeeds with reduced name coverage can still leave another customer hostname unprotected.

If issuance is pending or rate limited, follow the provider’s retry guidance instead of repeatedly forcing requests. An unrelated failing service subdomain may need a deliberate exclusion, but exclude only names that truly do not require this server’s certificate.

No. A redirect only changes the URL. Verify the TLS handshake, hostname coverage and certificate chain independently before enforcing HTTPS.

• Reviewing the configured WHM AutoSSL provider and account policy
• Diagnosing a pending Cloudflare edge certificate
• Enabling the cPanel HTTPS redirect without a redirect loop
• Adding an EasyApache PHP extension without changing every domain

• cPanel: Manage Autossl
• Let's Encrypt: Challenge Types