AutoSSL fails to generate certificates with "CERTIFICATE_IS_EXTERNALLY_SIGNED" error

Symptoms

After installing an external certificate, AutoSSL will no longer replace the certificate, even if it is set to expire. The AutoSSL log will have an entry similar to the following.

 Impediment: CERTIFICATE_IS_EXTERNALLY_SIGNED: The certificate is neither self-signed nor from AutoSSL.

Description 

By default, AutoSSL will not replace externally issued certificates. This prevents EV and OV certificates from being replaced. AutoSSL has a setting that allows it to replace these certificates. When you enable this option, AutoSSL will install certificates that replace users’ non-AutoSSL certificates if they are invalid or expire within three days.

Workaround

1. Log into WHM as the ‘root’ user.
2. Navigate to "Home / SSL/TLS / Manage AutoSSL."
3. Click the "Options" tab.
4. Enable the "Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates" option.
5. Click the "Save" button.

Additional resources

Manage AutoSSL: Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates