Free SSL certificates, the ones that put a padlock next to your website's address, are meant to renew themselves every 90 days without you doing anything. When that automatic renewal fails, your certificate quietly expires and visitors start seeing "Not Secure" or "Your Connection Is Not Private" warnings. This article explains why automatic renewal fails and how to fix it, whether you're on cPanel or DirectAdmin.
Why Automatic Renewal Fails
Automatic renewal works by re-verifying that your domain points to your hosting account, then issuing a new certificate. If that verification can't complete, the renewal is skipped and your old certificate is left to expire. The most common reasons are:
- Your domain's nameservers or DNS records no longer point to your hosting account, for example if you recently moved a domain or changed DNS providers.
- A CAA DNS record on your domain restricts which certificate authorities are allowed to issue a certificate, and it doesn't include the one your host uses.
- The domain has expired or is suspended, so validation can't reach it.
- A manually installed certificate is already active on the domain and is set to take priority over the automatic one.
- A subdomain, like www or mail, points somewhere else and isn't included in the renewal request.
If you recently pointed your domain to a new host or changed your nameservers, give DNS changes time to propagate before troubleshooting further. See How Long Do DNS Changes Take to Propagate? for typical timeframes.
How to Fix It
Start by confirming your domain's DNS actually points to your hosting account. Once that's confirmed, you can manually trigger a renewal instead of waiting for the next automatic attempt.
In cPanel
- Log in to cPanel and open SSL/TLS Status under the Security section.
- Select the domain, and any subdomains, you want secured, then click Run AutoSSL.
- Wait a few minutes and refresh the page. If it succeeded, the status will show a valid certificate with a new expiry date.
- If it fails again, check the AutoSSL log for the specific error message. It usually points straight to the cause, such as "CAA record prevents issuance" or "domain does not resolve to this server."
In DirectAdmin
- Log in to DirectAdmin and go to SSL Certificates under Account Manager.
- Choose Free & automatic certificate from Let's Encrypt.
- Select the domain, and any subdomains you want covered, then click Save to request the certificate again.
- If the request fails, DirectAdmin displays the reason on the same page, most often a DNS or validation issue.
If a CAA record is blocking issuance, you'll need to update or remove that DNS record before a certificate can be issued. Check your DNS zone editor for a record with type CAA if you're not sure whether your domain has one.
If Renewal Still Fails
If your DNS is correct and the certificate still won't renew, contact support with the exact error message from the AutoSSL log or DirectAdmin's SSL page. That message tells us exactly what's blocking issuance and lets us resolve it faster than starting from scratch.