[AutoSSL] Local HTTP DCV error 404 (not found) - Public IP on NAT Server

Symptoms

AutoSSL fails to validate local HTTP DCV and returns a 404 error:

CONFIG_TEXT: Local HTTP DCV error (domain.tld): The system queried for a temporary
file at “http://domain.tld/.well-known/.well-known/pki-validation/C0929066B92E85D215CD309A63D21F36.txt”, 
but the web server responded with the following error: 404 (Not Found). A DNS (Domain 
Name System) or web server misconfiguration may exist.

Cause

This may occur if the server's public IP address is added to the network configuration when the server is behind a NAT. A server using a NAT configuration must have all private IPs bound to the network interface and allow the NAT configuration to translate between private and public IPs. If a public IP address is added, it can and will cause issues with resolving things from within the server. You can verify your NAT configuration by running the following command in SSH as root:

# /usr/local/cpanel/scripts/build_cpnat

If an IP cannot be mapped properly, it will show as "Unable to map" as in this example:

CONFIG_TEXT: # /usr/local/cpanel/scripts/build_cpnat
info [build_cpnat] 172.16.0.0 => 203.0.113.0
warn [build_cpnat] Unable to map 203.0.113.0

Resolution

Remove the IPs that are unable to map through the WHM interface.

1. Access WHM as the root user.

2. Navigate to IP Functions / Show or Delete Current IP Addresses.

3. Click Delete in the row that corresponds to the IP address that says "Not Routable."

4. Click Confirm Delete to remove the IP