# Why AutoSSL didn't issue a certificate

> Your free SSL shows an error in cPanel's SSL/TLS Status? Here are the common reasons AutoSSL can't issue a Let's Encrypt certificate, and how to fix them.

Source: https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/autossl-not-issuing/

AutoSSL gives every domain on your hosting a free Let's Encrypt certificate, but Let's Encrypt first has to confirm the domain points to your hosting. If it can't, the domain shows a red or yellow status in cPanel's **SSL/TLS Status**. Hover over or expand the error to see the reason, then match it below.

## The domain doesn't point to Ruachost yet

**Error mentions:** DNS, "does not resolve to this server", or the wrong IP address.

The most common cause, especially for new domains and right after a move.

- Check the domain uses `nsa.ruachost.com` and `nsb.ruachost.com`, or has an A record pointing to your hosting IP. See [My DNS changes aren't working](https://helpcenter.ruachost.com/domains/dns/dns-changes-not-working/).
- Wait for DNS changes to spread (a few hours, up to 48 for nameservers), then click **Run AutoSSL**.

## www or a subdomain is missing from DNS

If `example.com` works but `www.example.com` (or `mail.`, `webmail.`) shows an error, that name has no DNS record. Add a CNAME for `www` pointing to your domain. See [My domain works without www but not with it](https://helpcenter.ruachost.com/domains/dns/domain-works-without-www/).

You can also exclude a subdomain you don't use: tick it in **SSL/TLS Status** and click **Exclude Domains from AutoSSL**.

## Cloudflare proxy is on

When Cloudflare's orange cloud is on, Let's Encrypt can't always reach your server directly. Either:

- set Cloudflare's SSL/TLS mode to **Full** (not Full (strict)) while you run AutoSSL again, or
- temporarily set the DNS records to **DNS only** (grey cloud), run AutoSSL, then turn the proxy back on.

## A CAA record blocks Let's Encrypt

**Error mentions:** CAA.

If your domain has CAA records, they must allow Let's Encrypt. Add a CAA record: `0 issue "letsencrypt.org"`, or remove the CAA records if you didn't add them on purpose. See [Managing DNS records](https://helpcenter.ruachost.com/domains/dns/dns-resource-records/).

## An .htaccess rule blocks the check

Let's Encrypt fetches a small file from `/.well-known/acme-challenge/`. Redirects, password protection or security rules in `.htaccess` can block it. Make sure that path isn't redirected or protected, then run AutoSSL again.

## Too many requests

**Error mentions:** rate limit.

Let's Encrypt limits how many certificates can be issued for a domain in a week. Wait a few days, then run AutoSSL again. Avoid running it repeatedly while DNS is still wrong.

## After fixing

1. In cPanel, open **SSL/TLS Status**.
2. Click **Run AutoSSL**.
3. Wait a few minutes and refresh.

Still red after 24 hours? [Open a support ticket](https://dashboard.ruachost.com/submitticket.php) with the domain and the error text.

## Related articles

- [Your free SSL certificate](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-install-ssl-certificate-on-your-site-using-lets-encrypt-ssl/)
- [Fixing "Your connection is not private" errors](https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/connection-not-private-errors/)