Checkallsslcerts fails with "400 (Bad Request)" for all service subdomains when using remote DNS

Symptoms

The following is returned when running /usr/local/cpanel/bin/checkallsslcerts for each service subdomain:

CONFIG_TEXT: The system failed to validate domain control for the domain “cpanel.hostname.domain.tld” using the “HTTP” DCV method: 403 urn:ietf:params:acme:error:unauthorized
(The client lacks sufficient authorization) (203.0.113.2: Invalid response from http://whm.hostname.domain.tld/.well-known/acme-challenge/string: 400)

The following is logged to /etc/apache2/logs/error_log:

CONFIG_TEXT: AH01215: stderr from /usr/local/cpanel/cgi-priv/get_local.cgi: 400: No cPanel user controls a local domain called \xe2\x80\hostname.domain.tld\xe2\x80\x9d. at cgi-priv/get_local.cgi.pl line 151.

Cause

The /usr/local/cpanel/bin/checkallsslcerts script returns the error for service subdomains when using remote DNS. This still occurs if the service subdomains resolve to the server.

We've opened an internal case for our development team to investigate this further. For reference, the case number is CPANEL-44036. Follow this article to receive an email notification when a solution is published in the product. 

Resolution

There are two available workarounds while the case is being reviewed internally. 

1. Host DNS locally on the cPanel server
2. Temporarily disable the Service Subdomains feature via WHM's Tweak Settings menu.