AutoSSL Certificate Won't Issue ("Not Secure" Warnings)

Summary: If a site shows "Not Secure" or a certificate error, AutoSSL probably couldn't issue a certificate for the domain, and this article covers the usual causes and how to run AutoSSL again.

How AutoSSL works

AutoSSL is built into cPanel & WHM. It automatically requests free SSL certificates for the domains on your server and renews them before they expire. To issue a certificate, the certificate authority has to confirm that the domain really points to your server. This is called domain control validation (DCV). Most AutoSSL failures happen because that check didn't pass.

Step 1: Read the AutoSSL log

1. In WHM, go to SSL/TLS » Manage AutoSSL.
2. Open the Logs tab and view the most recent log.
3. Search for the domain. The log explains why each domain or subdomain was skipped or failed.
4. On the Providers tab, note which certificate provider your server uses. You'll need it for the CAA check below.

Step 2: Confirm DNS points to your server

This is the most common cause. Check both the root domain and www:

dig +short clientdomain.com
dig +short www.clientdomain.com

Both should return your server's IP. If they don't:

• Update the A records, or switch the domain's nameservers to yours.
• Remove any old AAAA (IPv6) records that point to a previous host. Validation can fail when it's checked over IPv6.
• After a recent change, wait for DNS to update before re-running AutoSSL.

If only some subdomains, such as mail. or webdisk., fail because they don't resolve, AutoSSL simply leaves them off the certificate. The main domain can still be secured.

Step 3: Check CAA records

A CAA record tells certificate authorities which of them may issue certificates for a domain. If a domain has CAA records that don't include your server's AutoSSL provider, issuance fails.

dig +short CAA clientdomain.com

• No result means CAA isn't restricting anything, so move on to the next step.
• If records exist, add one that allows your AutoSSL provider. For example, use 0 issue "letsencrypt.org" if your provider is Let's Encrypt, or 0 issue "sectigo.com" if your provider is cPanel (Sectigo). Or remove the CAA records if nobody needs them.

Step 4: Cloudflare or another proxy

If the domain uses Cloudflare with the orange-cloud proxy turned on, visitors reach Cloudflare instead of your server. That can interfere with validation.

1. In Cloudflare, temporarily set the root domain and www records to DNS only (gray cloud).
2. Re-run AutoSSL (see Step 6) and wait for the certificate to issue.
3. Turn the proxy back on, and set Cloudflare's SSL/TLS mode to Full (strict).

Also check for firewall rules, "under attack" modes, or redirect rules that could block requests to /.well-known/ on the domain.

Step 5: Redirects and .htaccess rules

Custom rules in the site's .htaccess file, security plugins, or maintenance-mode plugins sometimes block the validation files under /.well-known/pki-validation/ or /.well-known/acme-challenge/. Temporarily turn off unusual rewrite rules, re-run AutoSSL, and then turn them back on.

Step 6: Re-run AutoSSL

• For one account in WHM: Go to SSL/TLS » Manage AutoSSL » Manage Users, find the user, and run the check for that user.
• For all accounts: On the Manage AutoSSL page, click Run AutoSSL For All Users.
• From the client's cPanel: Go to Security » SSL/TLS Status and click Run AutoSSL.
• From the command line (as root):

  /usr/local/cpanel/bin/autossl_check --user=USERNAME

Rate limits

Certificate authorities limit how many certificates, and how many failed attempts, a domain can have in a given period. If you've run AutoSSL many times in a row, the log may mention a rate limit. Fix the underlying cause first, then wait a few hours before you try again. Running it over and over won't help.

Certificate installed, but still "Not Secure"?

• Mixed content: The page loads images, scripts, or styles over http://. Update the site URL in the CMS to https://, and fix hard-coded links.
• No redirect: Visitors can still open the http:// version. In cPanel, turn on Domains » Force HTTPS Redirect for the domain.
• Old browser cache: Try a private window.

For more detail, see cPanel's Manage AutoSSL documentation.

Still stuck? Open a ticket

Our U.S.-based support team is available 24/7. Open a support ticket from the Liberation Client Area and include the domain name and the AutoSSL log lines for it. Tickets are private, so they are the safe place to share server details. Never post passwords in public forums or chats.