I have created a private cPanel ticket for this issue but wanted to post it here so other customers with similar issues could track its progress in case they experience something similar:
I have an account with a domain that the customer has registered and configured at the registrar with the A record pointing to my server. The nameservers point elsewhere because they want to manage their mail externally. This worked fine taking visitors to the site hosted on my server securely with the SSL cert that was installed.
On 1/3/2022, the SSL cert was expected to renew via AutoSSL. The AutoSSL log for this account from 1/3/2022 is included below. My primary company hosting domain is changed to "example.com" and the customer's domain/subdomain is changed to "customer". The primary customer domain for the site would be "customer.com" and the issue occurs with "mail.customer.com" as described in this log:
The email notification for this failure sent on 12/30/2021 had this message:
"AutoSSL would normally renew this certificate now, but 1 of the website’s secured domains just failed DCV. To provide you with more time to resolve this problem, AutoSSL will defer the renewal until Jan 1, 2022 at 12:00:00 AM UTC. After that time, AutoSSL will request a replacement certificate that excludes any domains that fail DCV. At the time of this notice, the certificate will expire in 3 days, 19 hours, 40 minutes, and 19 seconds."
However, it did not renew the other domains on the certificate, since going to "customer.com" gave an expired SSL message.
I had this happen to another customer about a month ago but it had never happened before over several years of using AutoSSL and customer domains that only have an A record that points to our server. I had to manually run another check for that domain and it corrected itself, but it should do it before the current cert expires so there is no downtime for the customer's site.
It seems something has changed with either AutoSSL or with Sectigo recently. Based on the email message, it would seem that AutoSSL expects to renew the valid parts of the cert regardless of the failure, but ultimately does not do so before the cert expires.
As I did last time, I ran an AutoSSL check manually on just the "customer" user account and it did issue the cert without the missing "mail.customer.com" domain, as it should. The problem is that it didn't do this automatically prior to the old certificate's expiration, leaving the customer without access to their site until my manual intervention.
I'm assuming this manual intervention should not be necessary, particularly provided the email message implying that AutoSSL would provide "a replacement certificate that excludes any domains that fail DCV."
cPanel ticket: https://support.cpanel.net/hc/en-us/requests/94401480
I have an account with a domain that the customer has registered and configured at the registrar with the A record pointing to my server. The nameservers point elsewhere because they want to manage their mail externally. This worked fine taking visitors to the site hosted on my server securely with the SSL cert that was installed.
On 1/3/2022, the SSL cert was expected to renew via AutoSSL. The AutoSSL log for this account from 1/3/2022 is included below. My primary company hosting domain is changed to "example.com" and the customer's domain/subdomain is changed to "customer". The primary customer domain for the site would be "customer.com" and the issue occurs with "mail.customer.com" as described in this log:
Code:
Verifying “cPanel (powered by Sectigo)”’s authorization on 12 domains via DNS CAA records …
11:18:59 PM “customer.example.com” is managed.
“www.customer.example.com” is managed.
“mail.customer.example.com” is managed.
“cpanel.customer.example.com” is managed.
“webdisk.customer.example.com” is managed.
“webmail.customer.example.com” is managed.
“cpcontacts.customer.example.com” is managed.
“mail.customer.com” is managed.
“www.customer.com” is managed.
“customer.com” is managed.
“cpcalendars.customer.example.com” is managed.
“autodiscover.customer.example.com” is managed.
All of this user’s 12 domains are managed.
CA authorized: “customer.example.com”
CA authorized: “www.customer.example.com”
CA authorized: “mail.customer.example.com”
CA authorized: “cpanel.customer.example.com”
CA authorized: “webdisk.customer.example.com”
CA authorized: “webmail.customer.example.com”
CA authorized: “cpcontacts.customer.example.com”
CA authorized: “cpcalendars.customer.example.com”
CA authorized: “autodiscover.customer.example.com”
CA authorized: “customer.com”
CA authorized: “www.customer.com”
CA authorized: “mail.customer.com”
“cPanel (powered by Sectigo)” is authorized to issue certificates for 12 of this user’s 12 domains.
11:18:59 PM Performing HTTP DCV (Domain Control Validation) on 12 domains …
11:18:59 PM Local HTTP DCV OK: customer.com
Local HTTP DCV OK: www.customer.com
WARN Local HTTP DCV error (mail.customer.com): The system queried for a temporary file at “http://mail.customer.com/.well-known/pki-validation/60AB477AA88A4AD2AF59E3F3474255E6.txt”, but the web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist. The domain “mail.customer.com” resolved to an IP address “207.204.50.27” that does not exist on this server.
Local HTTP DCV OK: customer.example.com
Local HTTP DCV OK: www.customer.example.com
Local HTTP DCV OK: mail.customer.example.com
Local HTTP DCV OK: cpanel.customer.example.com
Local HTTP DCV OK: webdisk.customer.example.com
Local HTTP DCV OK: webmail.customer.example.com
Local HTTP DCV OK: cpcontacts.customer.example.com
Local HTTP DCV OK: cpcalendars.customer.example.com
Local HTTP DCV OK: autodiscover.customer.example.com
11:18:59 PM Verifying local authority for 1 domain …
11:18:59 PM No local authority: “mail.customer.com”
It seems that AutoSSL/Sectigo couldn't find the "mail.customer.com" host, probably because the user didn't set it up at the registrar or wherever their DNS points to."AutoSSL would normally renew this certificate now, but 1 of the website’s secured domains just failed DCV. To provide you with more time to resolve this problem, AutoSSL will defer the renewal until Jan 1, 2022 at 12:00:00 AM UTC. After that time, AutoSSL will request a replacement certificate that excludes any domains that fail DCV. At the time of this notice, the certificate will expire in 3 days, 19 hours, 40 minutes, and 19 seconds."
However, it did not renew the other domains on the certificate, since going to "customer.com" gave an expired SSL message.
I had this happen to another customer about a month ago but it had never happened before over several years of using AutoSSL and customer domains that only have an A record that points to our server. I had to manually run another check for that domain and it corrected itself, but it should do it before the current cert expires so there is no downtime for the customer's site.
It seems something has changed with either AutoSSL or with Sectigo recently. Based on the email message, it would seem that AutoSSL expects to renew the valid parts of the cert regardless of the failure, but ultimately does not do so before the cert expires.
As I did last time, I ran an AutoSSL check manually on just the "customer" user account and it did issue the cert without the missing "mail.customer.com" domain, as it should. The problem is that it didn't do this automatically prior to the old certificate's expiration, leaving the customer without access to their site until my manual intervention.
I'm assuming this manual intervention should not be necessary, particularly provided the email message implying that AutoSSL would provide "a replacement certificate that excludes any domains that fail DCV."
cPanel ticket: https://support.cpanel.net/hc/en-us/requests/94401480
Last edited:
