AutoSSL doesn't renew certificate: One or more currently-secured domains failed DCV.

Symptoms

When attempting to renew your AutoSSL certificate, you encounter an error similar to the following.

Impediment: SECURED_DOMAIN_DCV_FAILURE: One or more currently-secured domains failed DCV.

Description

The error occurs when one or more of your currently protected subdomains fail the Domain Control Validation (DCV) check. AutoSSL avoids reducing security and will not issue a new certificate if it covers fewer domains than the current certificate. However, AutoSSL will attempt to order a certificate with reduced coverage three days before the existing certificate expires.

Workaround

Review the AutoSSL logs in more detail to determine what is causing the loss in coverage:

Where are AutoSSL logs stored?

Three days before the certificate expires, AutoSSL will attempt to order a certificate with reduced coverage, and the warnings will no longer occur. You can perform the following procedure to force the SSL to reissue with reduced coverage immediately: 

1. Access the server using "WHM" as the root user.
2. Navigate to "Home / SSL/TLS / Manage SSL Hosts"
3. Locate the domain you wish to renew the SSL for and "Delete" the SSL
4. Use one of the following methods to renew the AutoSSL for that user:
   How to manually renew AutoSSL certificates for one user