This article covers scenarios that lead to AutoSSL returning a 404 (not found) error when completing HTTP DCV.
Local HTTP DCV error (domain.tld): The system queried for a temporary
file at “http://domain.tld/.well-known/.well-known/pki-validation/C0929066B92E85D215CD309A63D21F36.txt”,
but the web server responded with the following error: 404 (Not Found). A DNS (Domain
Name System) or web server misconfiguration may exist.
Cause: 1:1 NAT with public IP added to the server
One cause of this error, assuming that the domain correctly resolves to the correct account IP address, is that the server is behind NAT and has the public IP address added as a second interface. The article "Should the public IP for my NAT be on my server?" also explains that a public IP address should not be added to a server that is behind NAT.
If you run the following command and see an internal IP address (see: How do I know if an IP address is internal or public?) mapped to a public IP address and another line where the same public IP address says "Unable to map," this applies to the server.
Example (in this example, 203.0.113.0 represents the public IP):
info [build_cpnat] 172.16.0.0 => 203.0.113.0
warn [build_cpnat] Unable to map 203.0.113.0
1. Navigate to WHM »IP Functions »Show or Delete Current IP Addresses
2. Click Delete in the row that corresponds to the IP address that says "Not Routable."
3. Click Confirm Delete.