Why AutoSSL didn't issue a certificate
AutoSSL gives every domain on your hosting a free Let’s Encrypt certificate, but Let’s Encrypt first has to confirm the domain points to your hosting. If it can’t, the domain shows a red or yellow status in cPanel’s SSL/TLS Status. Hover over or expand the error to see the reason, then match it below.
The domain doesn’t point to Ruachost yet
Section titled “The domain doesn’t point to Ruachost yet”Error mentions: DNS, “does not resolve to this server”, or the wrong IP address.
The most common cause, especially for new domains and right after a move.
- Check the domain uses
nsa.ruachost.comandnsb.ruachost.com, or has an A record pointing to your hosting IP. See My DNS changes aren’t working. - Wait for DNS changes to spread (a few hours, up to 48 for nameservers), then click Run AutoSSL.
www or a subdomain is missing from DNS
Section titled “www or a subdomain is missing from DNS”If example.com works but www.example.com (or mail., webmail.) shows an error, that name has no DNS record. Add a CNAME for www pointing to your domain. See My domain works without www but not with it.
You can also exclude a subdomain you don’t use: tick it in SSL/TLS Status and click Exclude Domains from AutoSSL.
Cloudflare proxy is on
Section titled “Cloudflare proxy is on”When Cloudflare’s orange cloud is on, Let’s Encrypt can’t always reach your server directly. Either:
- set Cloudflare’s SSL/TLS mode to Full (not Full (strict)) while you run AutoSSL again, or
- temporarily set the DNS records to DNS only (grey cloud), run AutoSSL, then turn the proxy back on.
A CAA record blocks Let’s Encrypt
Section titled “A CAA record blocks Let’s Encrypt”Error mentions: CAA.
If your domain has CAA records, they must allow Let’s Encrypt. Add a CAA record: 0 issue "letsencrypt.org", or remove the CAA records if you didn’t add them on purpose. See Managing DNS records.
An .htaccess rule blocks the check
Section titled “An .htaccess rule blocks the check”Let’s Encrypt fetches a small file from /.well-known/acme-challenge/. Redirects, password protection or security rules in .htaccess can block it. Make sure that path isn’t redirected or protected, then run AutoSSL again.
Too many requests
Section titled “Too many requests”Error mentions: rate limit.
Let’s Encrypt limits how many certificates can be issued for a domain in a week. Wait a few days, then run AutoSSL again. Avoid running it repeatedly while DNS is still wrong.
After fixing
Section titled “After fixing”- In cPanel, open SSL/TLS Status.
- Click Run AutoSSL.
- Wait a few minutes and refresh.
Still red after 24 hours? Open a support ticket with the domain and the error text.