[AutoSSL] Local HTTP DCV error 404 (not found) - IPv6 Record Issue

Symptoms

AutoSSL fails to validate local HTTP DCV and returns a 404 error:

CONFIG_TEXT: Local HTTP DCV error (domain.tld): The system queried for a temporary
file at “http://domain.tld/.well-known/.well-known/pki-validation/C0929066B92E85D215CD309A63D21F36.txt”, 
but the web server responded with the following error: 404 (Not Found). A DNS (Domain 
Name System) or web server misconfiguration may exist.

Cause

A domain with an AAAA record configured in the DNS, but no attached IPv6 IP in their cPanel account will often run into errors with AutoSSL. AutoSSL defaults to IPv6 if an AAAA record exists because the AutoSSL providers do the same. If the domain resolves to an IPv6 address and IPv6 isn't enabled on the account, Apache won't know what to do with the domain, so it serves the default virtualhost instead of the correct one.

You can check for an AAAA record easily with the host command:

CONFIG_TEXT: # host domain.tld
domain.tld has address 192.0.2.0
domain.tld has IPv6 address fe80::200:5aee:feaa:20a2
 

Resolution

If the server already has the IPv6 IP bound to the server, but not assigned to the account, you can use the instructions here to attach the IP to the cPanel account:

How to Assign or Enable IPv6 on a cPanel account

Otherwise, removing the AAAA record at the DNS provider will force AutoSSL to resolve using the IPv4 records.