Why AutoSSL fails

AutoSSL fails when Let’s Encrypt cannot complete domain control validation for your hostname. On our cPanel plans, AutoSSL uses Let’s Encrypt over HTTP-01, so the public path to your site must work before a certificate can issue. The status line in SSL/TLS Status usually names the real problem, such as DNS, port 80, CAA, a rate limit, or a CDN in the way.

Read the AutoSSL status line first

Open cPanel and go to SSL/TLS Status. The red text next to the domain is plain English about what failed. It often includes the exact hostname and the URL the certificate authority tried to reach. Copy that line before you change anything else. A vague note that SSL looks red costs time; the status text points to a specific fix.

Common messages map to simple causes. DCV failed or HTTP errors mean the challenge URL did not return the expected token. A CAA error means a DNS CAA record blocks letsencrypt.org. Rate limited means too many recent issuance attempts for that name, so you need to wait before you try again.

Check the path from the public internet

From the open internet, http://your-exact-hostname/.well-known/acme-challenge/ must reach this account’s virtual host on port 80. An A or AAAA record still aimed at an old host will fail validation. A long TTL you only just lowered may still be cached at some resolvers. A CDN or proxy that rewrites the challenge, forces HTTPS too early, or sends traffic to another origin will also fail. Firewall or security rules that block port 80 stop HTTP-01 cold. Names that exist only in a local hosts file are invisible to the CA.

Fix DNS and access, then retry once

Point the hostname’s DNS to this hosting account and confirm port 80 is open to the world. If you use CAA records, allow letsencrypt.org, and include issuewild only if you truly need wildcard coverage. Bypass or grey-cloud any CDN for the ACME path until the certificate exists. Then wait for the TTL that resolvers still hold, not only the new lower value you just set.

After that, run AutoSSL one more time. If it still fails, the new status line is what belongs in a support ticket. A paid certificate under SSL/TLS can protect the site while you repair HTTP-01, but it will not make AutoSSL ignore bad DNS. Protocol choices like TLS 1.2 versus 1.3 are unrelated to a failed domain control check, so you do not need to chase them for this error.