Your hosting's free SSL certificate (AutoSSL / Let's Encrypt) renews itself automatically, usually well before it expires. When a renewal fails, it's almost always because one of the names on the certificate no longer points to our server. This article shows how to find the name that's failing and fix it.
Why renewals fail
The free certificate covers your domain and several related names, such as www, mail, other subdomains, and any alias or parked domains on the same account. To issue or renew it, the certificate authority visits each name and checks that it reaches your hosting. If any required name fails the check, you may see "Authorization for the domain failed", or the renewal may quietly drop names.
| Cause | How to fix it |
|---|---|
A subdomain or alias domain points somewhere else, or nowhere (for example an old lx. or shop. subdomain, or an alias domain you stopped using) | Point it back to your hosting, or remove it from your hosting account. You can also exclude it from the free certificate (see below). |
| The www version has no DNS record | Add a CNAME record for www that points to your domain, or an A record to your hosting IP. |
| Your domain expired, or its nameservers changed | If the domain lapsed, the registrar may point it to a parking page. Renew the domain and check the nameservers are correct. The certificate renews once DNS points back to us. |
| DNS is managed somewhere else (for example GoDaddy) | Log in to that provider and make sure the A records for the domain and www point to your hosting IP. We can't change DNS we don't manage. |
| Cloudflare's proxy (orange cloud) is on | Set Cloudflare's SSL mode to Full or Strict. See Cloudflare: SSL/TLS Settings (Crypto). |
| A CAA record blocks the certificate authority | If your DNS has CAA records, they must allow letsencrypt.org and sectigo.com. Remove or update them. |
Find out which name is failing (cPanel)
- Log in to the Client Area, open your hosting service and click Log in to cPanel.
- Open SSL/TLS Status (type it in the search box at the top).
- Each name shows a status. Names with a red or yellow icon aren't covered. Hover over or click the icon to see the reason, for example "DNS DCV: The domain resolves to an IP address that is not on this server".
Fix it and renew
- Fix the DNS for any name you still use (see the table above). DNS changes can take a few hours.
- For names you don't use, tick them in SSL/TLS Status and click Exclude Domains from AutoSSL. The certificate can then renew without them.
- Click Run AutoSSL. It can take a few minutes. Refresh the page to see the new status.
If your hosting uses Plesk
In Plesk, open Websites & Domains, click SSL/TLS Certificates for the domain and reissue the Let's Encrypt certificate. If you get "Authorization for the domain failed", untick any alias or subdomain that doesn't point to the server (or remove the alias under Domain Aliases), then try again.
Still not renewing?
Open a support ticket with the domain and a screenshot of the error or the SSL/TLS Status page. We'll run it from our side and tell you which record needs to change.
