Your site was fine yesterday. Today a visitor emails you a screenshot of Chrome saying "Not Secure" right next to your domain, and the little padlock is gone. Nothing in WordPress changed, nobody touched DNS on purpose — but the SSL certificate cPanel was supposed to keep renewing has quietly stopped working. Here's how to actually fix it instead of just clicking "Run AutoSSL" and hoping.

Symptom

You'll usually see one or more of these:

  • Browser address bar shows Not Secure or a padlock with a warning triangle
  • Visiting the site throws NET::ERR_CERT_DATE_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID
  • cPanel → SSL/TLS Status shows a red or yellow marker next to the domain
  • An email from your host titled something like "AutoSSL renewal failed for example.com"

Why AutoSSL Fails: The Real Causes

cPanel's AutoSSL (usually backed by Let's Encrypt or Sectigo, depending on your host's setup) tries to renew certificates automatically every few days. It fails silently more often than people realize, and almost always for one of these reasons:

CauseWhat's Happening
Domain Control Validation (DCV) failureThe certificate authority couldn't confirm you own the domain — usually because DNS or the A record points somewhere else
CAA record blocks the issuerA CAA DNS record restricts which certificate authorities may issue certs, and it doesn't list Let's Encrypt/Sectigo
Cloudflare or another proxy in frontThe orange-cloud proxy answers HTTP validation requests instead of your actual server
Rate limitingToo many failed attempts or too many certs issued for the same domain in a short window
Mixed content, not SSL at allThe cert is valid, but the page loads some resources over plain http://, so the browser still flags it
Expired & AutoSSL was disabledSomeone (or a plugin) manually installed a paid cert previously, which can turn off AutoSSL for that domain

Step 1: Confirm What You're Actually Dealing With

Before touching anything, check the certificate cPanel currently has installed:

  1. Log in to cPanel → go to SSL/TLS Status under the Security section
  2. Find your domain in the list and note the expiry date and issuer shown
  3. Click Run AutoSSL for that domain and watch the log it generates — this is the important part, not the button itself

The AutoSSL log tells you exactly why it failed. Look for lines mentioning dcv, CAA, or rate limit — that's your actual cause, not a guess.

Step 2: Fix DCV Failures (the most common cause)

DCV fails when the certificate authority's validation request can't reach your server the way it expects. Check:

  • Does the domain's A record point to this server's IP? Run dig example.com A +short and compare it to your server's public IP in WHM.
  • Is there a Cloudflare (or similar) proxy enabled? If the orange cloud is on, temporarily set it to "DNS only" (grey cloud), let AutoSSL run, then turn proxying back on afterward. Or better — use Cloudflare's own edge SSL and stop relying on cPanel's cert for that domain.
  • Is port 80 open? HTTP validation needs port 80 reachable from the internet, even if you force HTTPS everywhere. Check your firewall isn't blocking it: ufw status or check WHM → ConfigServer Security & Firewall.

Step 3: Check for a Blocking CAA Record

CAA records are easy to forget about since they're rarely touched, but one wrong entry blocks every renewal. Check yours:

dig example.com CAA +short

If you get output and it doesn't include letsencrypt.org or sectigo.com (whichever your host's AutoSSL provider is), that's your problem. Either remove the CAA record entirely or add the correct issuer, e.g.:

example.com. IN CAA 0 issue "letsencrypt.org"

Step 4: Clear Rate-Limit and Retry

Let's Encrypt allows a limited number of certificates per exact domain set per week. If you've been toggling DNS, adding/removing subdomains, or re-running AutoSSL repeatedly while troubleshooting, you may have hit the limit. The AutoSSL log will say so explicitly. There's no workaround here except waiting — usually a few hours to a week depending on which limit was hit. Fix the underlying DCV or CAA issue first, then let it retry on its normal schedule instead of forcing it every ten minutes.

Step 5: Force HTTPS Once the Certificate Is Actually Valid

A fresh, valid certificate doesn't automatically mean every page loads securely. If old links or embedded scripts still call http://, browsers will still flag mixed content. Add a redirect in .htaccess at your document root:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For WordPress specifically, also update Settings → General so both the WordPress Address and Site Address use https://, then run a search-and-replace across the database for any hardcoded http://example.com references left in post content or widgets.

Prevention: Stop This From Happening Again

  • Don't add CAA records unless you know exactly which CA your host uses for AutoSSL
  • If you're using Cloudflare, decide up front: either full-strict SSL with Cloudflare's own certs, or DNS-only with cPanel's AutoSSL — don't try to mix both without understanding the validation path
  • Set a calendar reminder to glance at SSL/TLS Status monthly, especially after any DNS changes
  • Avoid manually uploading a "temporary" paid certificate unless you actually intend to keep managing it yourself — it silently disables AutoSSL for that domain

Frequently Asked Questions

Why did my SSL certificate suddenly stop working with no changes on my end?

AutoSSL renews certificates roughly every 60-90 days. If a DNS change, a new firewall rule, or a Cloudflare proxy toggle happened anytime in that window — even weeks ago — the next renewal attempt can fail silently until the certificate actually expires and browsers start warning visitors.

Do I need to buy a paid SSL certificate to fix this?

No. AutoSSL issues free domain-validated certificates automatically, and they're perfectly sufficient for the vast majority of sites. Paid certificates only matter if you specifically need extended validation, a wildcard for many subdomains your host's AutoSSL doesn't cover, or a specific compliance requirement.

Can I run AutoSSL manually instead of waiting for the automatic cycle?

Yes — in cPanel go to SSL/TLS Status, select the domain, and click Run AutoSSL. In WHM you can trigger it for all accounts under Manage AutoSSL. Just don't spam the button while troubleshooting a DCV issue, since repeated failed attempts count toward Let's Encrypt's rate limits.

Why does Cloudflare cause AutoSSL to fail?

When Cloudflare's proxy (orange cloud) is active, DNS resolves to Cloudflare's IPs, not your server. The certificate authority's validation request then hits Cloudflare instead of cPanel, so domain validation fails. Switching to DNS-only mode during renewal, or relying on Cloudflare's own SSL layer instead, resolves it.

My certificate is valid but the browser still shows "Not Secure" — why?

This is almost always mixed content: some images, scripts, or stylesheets on the page are still being loaded over plain http://. Check the browser's developer console for blocked or insecure resource warnings, then update those references to https:// or protocol-relative URLs.