Renewal proves domain control again. A certificate can work today while HTTP-01 validation reaches an old IP, an unreachable IPv6 host, a blocked /.well-known/acme-challenge/ path or the wrong virtual host.
Preserve the exact ACME client/panel error. Repeated blind attempts can hit rate limits without fixing validation.
Record certificate and renewal state
Note covered names, issuer, expiry, panel/client, last success and exact error with timestamp.
Check:
root and www SANs
A/AAAA answers
challenge type
validation URL/status
ACME account/client log
renewal timer/cronDo not share private keys or ACME account credentials.
Verify DNS for every name
All requested hostnames must resolve according to the challenge design. An old AAAA record can make validation fail even when browsers normally use IPv4.
Confirm authoritative nameservers and CAA records. A restrictive CAA must permit Let’s Encrypt.
Remove unused SANs or correct their DNS; one failing name can block the whole certificate order.
Test the HTTP-01 path
Request a controlled file under:
http://example.com/.well-known/acme-challenge/test-tokenIt must reach the correct webroot/virtual host. Redirect to HTTPS is often acceptable when final access remains valid, but login, maintenance, language or application rewrites must not consume the challenge.
Do not expose the ACME directory as executable PHP.
Inspect virtual host and webroot
cPanel/Plesk/Certbot must write the token into the document root served for that hostname. Aliases and addon domains can map elsewhere.
Check Nginx location/Apache Alias order. Create a narrow static exception before WordPress rewrite.
Avoid manually copying tokens; automatic renewal must work without intervention.
Check firewall and CDN
Allow public HTTP validation from Let’s Encrypt according to the client/provider design. A broad bot challenge, geo-block or CDN Worker may intercept the path.
Create a narrow bypass for the challenge and keep normal security elsewhere.
For Cloudflare DNS-01, use a scoped API token stored securely; never a global API key in public files.
Handle DNS-01 and wildcard certificates
Wildcard names require DNS-01. The client creates _acme-challenge TXT records and waits for authoritative propagation.
Check CNAME delegation and whether another automation removes or replaces TXT values. Simultaneous orders can require multiple valid values. Use a narrowly scoped DNS token outside the web root and rotate it if exposed.
Check competing certificate managers
cPanel AutoSSL, Plesk, Certbot and a CDN can each manage certificates. Two clients may overwrite files, use different account keys or renew different virtual hosts.
Choose an owner for each TLS termination point. Disable duplicate jobs only after documenting coverage, including mail/panel services that may use the same certificate path.
Record renewal notifications and escalation ownership so an unattended failure is acted on before expiry, even when the normal administrator is unavailable.
Review rate limits and time
Read the ACME response for retry timing. Use Let’s Encrypt staging for repeated configuration tests.
Ensure server time and renewal cron/timer are correct. A disabled cron or failed panel task means validation is never attempted automatically.
Do not continually request duplicate production certificates during troubleshooting.
Deploy the renewed certificate
Success from the ACME client does not prove Nginx/Apache loaded the new files. Check served certificate serial/expiry on root and www, then reload through supported controls.
In clusters/load balancers, deploy to every termination point. One old node creates intermittent expiry warnings.
Protect private key permissions and backups.
Verify automatic renewal
Run the client’s dry-run/staging renewal, inspect timer logs and set an external expiry alert well before renewal.
Test HTTPS, chain, redirects and WordPress login. Recurring care should monitor both expiry and last successful renewal; an unexpired certificate can still have a broken automated renewal path.