AutoSSL not renewing some domains

[stec]

Hi,

We have successfully setup 5 domains with AutoSSl (let's encrypt).
We use an external DNS
-> Let's encrypt should query the website to validate the certificat.


For one domain (the main one), AutoSSL isn't able to renew a certificat.

In AutoSSL log:
WARN DNS query error (domain.ltd/NS): SERVFAIL (2)
10:28:56 AM ERROR “domain.ltd” is unmanaged. Verify this domain’s registration and authoritative nameserver configuration to correct this problem.
WARN DNS query error (www.domain.ltd/NS): SERVFAIL (2)
10:28:56 AM ERROR “www.domain.ltd” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.ltd” to correct this problem.
10:28:56 AM WARN DNS query error (www.domain.ltd/CAA): SERVFAIL (2)
WARN DNS query error (domain.ltd/CAA): SERVFAIL (2)
.
.
.
10:28:56 AM Processing “xxxx”’s local DCV results …
10:28:56 AM Analyzing “domain.ltd”’s DCV results …
10:28:56 AM ERROR Impediment: NO_UNSECURED_DOMAIN_PASSED_DCV: Every unsecured domain failed DCV.
10:28:56 AM The system has completed “xxxx”’s AutoSSL check.



In apache log:

x.x.x.x - - [27/Apr/2023:06:47:02 +0000] "GET /.well-known/acme-challenge/UF143GXP-8J2XZKLQ8A7Y-M2T8-AVOMB HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0"
54.202.80.79 - - [27/Apr/2023:06:47:04 +0000] "GET /.well-known/acme-challenge/p-3qBXdmZ_1719-HmaC-8pno2-l1zIWTai-pbP-9rh8 HTTP/1.1" 200 107 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +Let's Encrypt)"


External DNS give the correct IPV4 IP when we resolve domain.ltd or www.domain.ltd.
Let's encrypt seem to be able to query the website.

How to find why AutoSSL isn't able to renew the certificat.

thank's for your help.

 

[cPRex]

Hey there! If you run this command on the server, does that return the correct nameservers for the domain that is having issues with AutoSSL?

/usr/local/cpanel/3rdparty/bin/perl -MCpanel::DnsRoots -MData::Dumper -e 'print Dumper(Cpanel::DnsRoots->new()->get_nameservers_for_domain("google.com"));'

Just replace "google.com" while keeping the quotes, and the command will give you output.

 

[stec]

yes it return the correct servers and each nameserver return correct IP when I resolve my domain with the command :
dig xxx.gandi.net domain.ltd +short

 

[cPRex]

We may need to see a ticket on this issue so we can investigate directly. Could you submit one to our team and then post the number here so I can follow along?