Read the domain-specific failure and record the affected hostname. Verify A and AAAA destinations, relevant CAA policy, validation-path accessibility and domain inclusion. Keep an existing valid certificate installed while investigating.

1. Open SSL/TLS Status or the unified SSL/TLS Certificates Status tab to inspect the certificate and reported status.
2. Correct the actual validation issue. For example, remove an obsolete IPv6 destination only when it is truly wrong, or allow the required validation request through an application redirect or firewall.
3. Use Run AutoSSL where the standalone interface exposes it. The current unified Status tab hides AutoSSL actions, so an absent button there is not evidence that automation is broken.
4. If no manual action is available, ask support to review the scheduled job or available issuer workflow after the prerequisite problem is resolved.
5. Wait for completion, then verify the new certificate’s names and expiry and test the site over HTTPS.

Each required hostname should have valid coverage, including any www or service name actually used. Confirm the live connection rather than relying only on a queued-job message.

If validation still fails, send support the exact hostname, error and recent DNS changes. Do not replace a valid certificate with a self-signed one to clear a status display. AutoSSL does not correct mixed-content links inside an application automatically.

• Getting a free HTTPS certificate for a cPanel website
• Choosing which cPanel hostnames AutoSSL should manage
• Adding an IPv4 A record in cPanel Zone Editor
• Generating a certificate signing request in cPanel

• cPanel: SSL TLS Status
• cPanel: SSL TLS Certificates