AutoSSL doesn't renew certificate: One or more currently-secured domains failed DCV.

Symptoms

When attempting to renew your AutoSSL certificate you encounter an error similar to the following.

Impediment: SECURED_DOMAIN_DCV_FAILURE: One or more currently-secured domains failed DCV.

Description

The error occurs when one or more of your currently protected subdomains fail the Domain Control Validation (DCV) check. AutoSSL avoids reducing security and will not issue a new certificate if it covers fewer domains than the current certificate. However, AutoSSL will attempt to order a certificate with reduced coverage three days before the existing certificate expires.

Workaround

Wait until three days before the certificate expires, then check for any additional impediments.