Troubleshooting SSL certificate renewals for Cloudflare-enabled domains

Learn how to resolve SSL renewal issues that occur when Cloudflare interferes with domain control validation (DCV).

Problem

When renewing an SSL certificate on a Cloudflare-enabled domain, the process may fail. In cPanel, you may see an error such as:

DNS DCV: No local authority
HTTP DCV: “cPanel (powered by Sectigo)” forbids DCV HTTP redirections.

If you are a reseller using WHM, you might see:

WARN Local HTTP DCV error: “cPanel (powered by Sectigo)” forbids DCV HTTP redirections.

These errors happen because Cloudflare redirects traffic in a way that prevents cPanel from verifying domain ownership during renewal.

Resolution

You do not need to disable Cloudflare entirely. Only certain Cloudflare settings must be adjusted to allow the DCV checks to pass.

Follow the steps below:

1. Disable “Always Use HTTPS”

1. Log in to your Cloudflare account.
2. On the Home tab, select your domain.
3. Click SSL/TLS, then go to the Edge Certificates tab.
4. Disable the Always Use HTTPS toggle.

Important:
Leave this setting disabled permanently.
If you want to force HTTPS, use:

• .htaccess redirects, or
• your CMS settings (e.g., WordPress Site Address URLs).

2. If Renewal Still Fails, Check These Cloudflare Settings

Automatic HTTPS Rewrites

• Found under SSL/TLS → Edge Certificates
• If enabled, temporarily disable it during the renewal process.

SSL/TLS Encryption Mode

• Found under SSL/TLS → Overview
• If set to Full (strict), temporarily switch it to Full until renewal completes.

After adjusting these settings, AutoSSL or Sectigo validation should complete successfully, allowing your SSL certificate to renew without errors.