AutoSSL doesn't renew certificate: One or more currently-secured domains failed DCV.

Symptoms

When attempting to renew your AutoSSL certificate, you encounter an error similar to the following.

CONFIG_TEXT: Impediment: SECURED_DOMAIN_DCV_FAILURE: One or more currently-secured domains failed DCV.

Cause

The error occurs when one or more of your currently protected subdomains fail the Domain Control Validation (DCV) check. AutoSSL avoids reducing security and will not issue a new certificate if it covers fewer domains than the current certificate. However, AutoSSL will attempt to order a certificate with reduced coverage three days before the existing certificate expires.

Resolution

Review the AutoSSL logs in more detail to determine what is causing the loss in coverage:

Where are AutoSSL logs stored?

Three days before the certificate expires, AutoSSL will attempt to order a certificate with reduced coverage, and the warnings will no longer occur. You can perform the following procedure to force the SSL to reissue with reduced coverage immediately: 

1. Access the server using WHM as the root user.
2. Navigate to Home / SSL/TLS / Manage SSL Hosts.
3. Locate the domain you wish to renew the SSL for and Delete the SSL.

4. Re-run AutoSSL for the user:

   How to manually renew AutoSSL certificates for one user