In Progress CPANEL-42253 - Can't renew root server SSL certificate

[Okaro]

Hello.

I don't know what is happening, but the SSL of the domain that I use for the server is not renewed. The one I use to access my WHM, and cPanel accounts example:

https://server.myserver.xyz:2083

https://server.myserver.xyz:2087

If I'm not mistaken, this would be the third time it has been renewed, but I don't remember if it was renewed on its own or if I did something.

But this time I'm recieving one of this email everyday for every service, exim, dovecot, cpanel etc... :



In "Manage Service SSL Certificates" I don't have a "renew" option.



Any help will be appreciated.

Thanks.

 

[quietFinn]

That is normal, the message says that certificates will expire in less than 30 days, but cPanel will (most likely) install new ones automatically before they expire.

 

[cPRex]

I'm going to make an improvement case for this for a couple reasons:

1 - the cutoff is actually 25 days. If you run /usr/local/cpanel/bin/checkallsslcerts, you get this message:

The “cpanel” service’s current certificate comes with the server’s cPanel license. This certificate expires in less than 25 days. The system will attempt to renew and install a new certificate to the “cpanel” service and any other services that use the old certificate.

(bold emphasis added by me)

2 - The email doesn't provide a way to execute that command to renew the free certificate.

I've created CPANEL-42253 for our developers to look into this, and I'll be sure to post an update here once I have more information.

 

[Okaro]

I don't know what happened.

Until now, every day get an email with an different error, like:

"The system failed to acquire a signed certificate from the cPanel Store because of the following error: (XID qw6hgf) "
"The system failed to acquire a signed certificate from the cPanel Store because of the following error: (XID m2ee9u)"

and other errors...

Also tried a bunch of terminal commands with result of errors like:

"Attempting HTTP DCV preflight check does not resolve to any IP addresses on the internet"

But today, when I woke up, Voila!!

Domain renewed!

But...



... only for three months?

Is this normal?

Thanks.

 

[cPRex]

Yes, the AutoSSL certificates are only issued for three months, so that is completely normal. The previous messages you are seeing are the normal delays due to the SSL provider, Sectigo, being overloaded.

 

[Okaro]

Ok.

Thanks cPRex for your answers.