Sectigo cpanel SSL error: You do not own the following domain ... at .../Cpanel/SSL/Auto/Provider/cPanel.pm line 208

[ottdev]

Is there another log that says what failed at this line in the code?
"at /usr/local/cpanel/Cpanel/SSL/Auto/Provider/cPanel.pm line 208"
Everything checks out. A new .txt file is placed in /.well-known/pki-validation/ and is visble on the website. Comodo server sees it as well:
x.x.x.x - - [21/Apr/2022:19:41:01 -0400] "GET /.well-known/pki-validation/9F4............5D0D.txt HTTP/1.1" 200 77 "-" "COMODO DCV"

partial snippet
All of this user’s 8 domains are managed.
“cPanel (powered by Sectigo)” is authorized to issue certificates for 8 of this user’s 8 domains.
Analyzing “xxxxxxx.tld”’s DCV results …
6:11:55 PM AutoSSL will request a new certificate.
6:11:55 PM The system will attempt to renew the SSL certificate for (xxxxxxx.tld: xxxxxxx.tld www.xxxxxxx.tld mail.xxxxxxx.tld webmail.xxxxxxx.tld cpanel.xxxxxxx.tld webdisk.xxxxxxx.tld cpcontacts.xxxxxxx.tld cpcalendars.xxxxxxx.tld).
WARN (XID heqpse) You do not own the following domain: www.xxxxxxx.tld. at /usr/local/cpanel/Cpanel/SSL/Auto/Provider/cPanel.pm line 208.
WARN AutoSSL cannot secure any of “xxxxxxx.tld”’s domains.


 

[cPRex]

Hey there! I'm wondering if this is an actual domain configuration problem, and not an issue with the AutoSSL system. We use the "You do not own the following domain" language in other areas of domain management on the system, so my best guess is that a subdomain or addon domain isn't properly configured.

Could you try running this command on the domain giving the error to see what it says?

whmapi1 getdomainowner domain='yourdomain.com'

 

[ottdev]

That command gives the correct username is given for whom the AUTO SSL is being run. Reason: OK result:1 version:1
It ran A-OK last in November; that 3 month cert expired in Feb and since the system started attempting to renew it early in January, it's failing with this error.
Nothing has changed in that account for a year, and it is the primary/only domain in that account.
Tried running AutoSSL from WHM and from user's cPanel.

 

[cPRex]

Thanks for that confirmation. I don't have much other information about this particular error on my end. Could you submit a ticket to our team so we can examine that system directly?

 

[SiMoofus]

I too had out of date certificates dating back to February. I had to login to each individual cpanel to run autossl to fix. Running autossl from WHM just seemed to put the missing and out of date requests into a pending queue. With 12 accounts, laborious but not as bad as it might be for others. Only found out the workaround yesterday. I have not had my system running long enough to fully report behaviours. Awaiting the next batch of renewals to come up.

 

[ottdev]

RESOLVED via ticket
Recent changes in how they determine a subdomain is owned by the account resident on the server:

https://support.cpanel.net/hc/en-us/articles/4413888647191-AutoSSL-orders-are-stuck-in-pending-status-with-recent-HTTP-DCV-changes

In this case, the domain had been migrated last year from an add-on to its own account and was found to be missing a serveralias entry, which wasn't factored in during the previous 4 quarterly cert issuances.