# Troubleshooting SSL certificate renewals for Cloudflare-enabled domains

> Fix SSL certificate renewals that fail on Cloudflare-enabled domains by adjusting HTTPS and encryption settings.

Source: https://helpcenter.ruachost.com/add-ons/cloudflare/troubleshooting-ssl-certificate-renewals-for-cloudflare-enabled/

Learn how to resolve SSL renewal issues that occur when Cloudflare interferes with domain control validation (DCV).

### **Problem**

When renewing an SSL certificate on a Cloudflare-enabled domain, the process may fail. In cPanel, you may see an error such as:

**DNS DCV:** No local authority\
**HTTP DCV:** “cPanel (powered by Sectigo)” forbids DCV HTTP redirections.

If you use WHM, you might see:

**WARN Local HTTP DCV error:** “cPanel (powered by Sectigo)” forbids DCV HTTP redirections.

These errors happen because Cloudflare redirects traffic in a way that prevents cPanel from verifying domain ownership during renewal.

### **Resolution**

You do **not** need to disable Cloudflare entirely. Only certain Cloudflare settings must be adjusted to allow the DCV checks to pass.

Follow the steps below:

### **1. Disable “Always Use HTTPS”**

1. Log in to your Cloudflare account.
2. On the **Home** tab, select your domain.
3. Click **SSL/TLS**, then go to the **Edge Certificates** tab.
4. Disable the **Always Use HTTPS** toggle.

**Important:**\
Leave this setting disabled permanently.\
If you want to force HTTPS, use:

- `.htaccess` redirects, or
- your CMS settings (e.g., WordPress Site Address URLs).

### **2. If Renewal Still Fails, Check These Cloudflare Settings**

#### **Automatic HTTPS Rewrites**

- Found under **SSL/TLS → Edge Certificates**
- If enabled, temporarily disable it during the renewal process.

#### **SSL/TLS Encryption Mode**

- Found under **SSL/TLS → Overview**
- If set to **Full (strict)**, temporarily switch it to **Full** until renewal completes.

After adjusting these settings, AutoSSL or Sectigo validation should complete successfully, allowing your SSL certificate to renew without errors.