Skip to main content

How to fix preflight checks failure?

Bert de Jong
What does this mean, and how do I fix it? The system failed to acquire a signed certificate from the cPanel Store because of the following error: Neither HTTP nor DNS DCV preflight checks succeeded! I cannot find any information via Google. Thanks,

Comments

28 comments

Date Votes
  • quanin
    Sounds like the CPanel store might be having temporary SSL issues. Try again a bit later, perhaps? If I need to, I can spin up a VPS to test from in case it's a more wide-spread thing.
    0
  • cPanelMichael
    Hello @Bert de Jong, It looks like the AutoSSL validation process failed for the domain. Check out our
    0
  • Bert de Jong
    In case someone finds this thread after searching for the error message, According to my VPS provider the error is related to the certificate generated for the server itself. This is auto-generated, even without the admin's request, and this is also why no information is available in the Logs of WHM's "Manage AutoSSL" section. The error is caused by a mismatch between the server's cPanel (sub)domain and/or (reverse?) DNS and/or hostname. Manually looking at the log file will give more information. According to my VPS provider, it should be okay to just ignore the error.
    0
  • cPanelMichael
    The error is caused by a mismatch between the server's cPanel (sub)domain and/or (reverse?) DNS and/or hostname. Manually looking at the log file will give more information. According to my VPS provider, it should be okay to just ignore the error.

    Hello @Bert de Jong, If you're referring to the SSL certificate for the server's hostname, you can run the following command to verify if it continues to fail: /usr/local/cpanel/bin/checkallsslcerts
    Let us know if any issues persist. Thank you.
    0
  • paulapatrice
    Was this resolved or was the warning ignored? I explored 13069213 UPDATE / RESOLVED The default hostname assigned by the VPS host did not resolve to an IP address and therefore the SSL couldn't verify it. Solution was to create a custom qualified domain name (like sub.domainname.com) and point it to the VPS primary IP, then in WHM change the hostname on the VPS to the new custom name. After doing so cPanel automatically issued and assigned a free SSL to the new hostname. It sounded complicated but it wasn't. Took 15 minutes, cPanel software handled all the changes flawlessly and shazaam it was fixed. Instructions to change the hostname here:
    0
  • cPanelMichael
    Hello :) I'm happy to see the issue was solved. Thanks for sharing the outcome!
    0
  • AlanB
    Was this resolved or was the warning ignored? I explored 13069213 UPDATE / RESOLVED The default hostname assigned by the VPS host did not resolve to an IP address and therefore the SSL couldn't verify it. Solution was to create a custom qualified domain name (like sub.domainname.com) and point it to the VPS primary IP, then in WHM change the hostname on the VPS to the new custom name. After doing so cPanel automatically issued and assigned a free SSL to the new hostname. It sounded complicated but it wasn't. Took 15 minutes, cPanel software handled all the changes flawlessly and shazaam it was fixed. Instructions to change the hostname here:
    0
  • dexterwebn
    Hey. I've actually been ignoring this error for a while because it is harmless, however this error usually pops up when people are using Cloudflare and other CDN services? If you are, the fix is pretty simple. Configure a DNS A NAME record for the hostname pointed to the IP address, then run the /usr/local/cpanel/bin/checkallsslcerts from the terminal. Next time you connect your ftp service you'll get a certificate warning about whether to store it or not, but that's about it. I remembered my CDN service when I pinged my hostname and it came back "not found". I was like, "yeah. That's not supposed to happen". Sure enough, when I put the hostname in a browser to confirm, and the error message was also not found I knew where I slipped up. If you're using a CDN the A NAME needs to be configured as well. It's worth a check at least. I hope this actually helps before someone dives down the hole of changing hostname.
    0
  • JohnnyBgood
    Hi - i'm having the same problem - and I use cloudlfare. @dexterwebn - when I try your suggestion - when I visit server.example.com - I get a Error 526: Invalid SSL certificate page. I added the A record - server to my servers IP in cloudflare. Any advice?
    0
  • paulapatrice
    Hi - i'm having the same problem - and I use cloudlfare. @dexterwebn - when I try your suggestion - when I visit server.example.com - I get a Error 526: Invalid SSL certificate page. I added the A record - server to my servers IP in cloudflare. Any advice?

    Is it a self-signed SSL cert (compliant only with CF SSL mode "full") or issued from a certificate authority (compliant with CF SSL mode "full-strict")?
    0
  • JohnnyBgood
    Thanks for the follow up paulapatrice. I use "full-strict" with cloudflare - an edge and origin certificate. the certificate covers *.example.com The SSL works fine on my site - when you visit example.com - I get the "little lock" and no errors. But when I check: Home " SSL/TLS " Manage SSL Hosts I see the following: cpanel.example.com mail.example.com example.com webdisk.example.com webmail.example.com www.example.com
    There is no server.example.com which is what my host name is. I don't know if that should be in there - or how to add it. Maybe that could be the problem.
    0
  • quietFinn
    @JohnnyBgood go to WHM -> Service Configuration -> Manage Service SSL Certificates
    0
  • paulapatrice
    @JohnnyBgood you are looking at the cPanel user accounts SSL/TLS. cPanel should have automatically issued a free SSL to the new hostname when it was created. If a cert is issued you can assign it by going to:
    • WHM -> Service Configuration -> Manage Service SSL Certificates
    • Certificate properties should be listed for each service.
      • If they are listed then this is prob not your issue. If cert properties are missing then:
    • Install a New Certificate > Browse Certificates > Browse Account "root" > Select certificate issued by cPanel, Inc or other issuer (not self-signed) > Select
    • Check boxes to install on all services in list
    • Confirm the list of services now has valid certificate assigned under Certificate Properties at the top of the page
    0
  • JohnnyBgood
    When I go to >>Manage Service SSL Certificates Each of the services have a valid self-signed certificate. (With a warning: Self-signed certificates will cause browser warnings.) As a cloudflare certificate user - should I have also installed the cloudflare certificate in this part of WHM??? A second question - when this is all working correctly - should it be possible to visit server.example.com in a browser? Thanks again for the help :)
    0
  • quietFinn
    "JohnnyBgood cPanel should install free Service SSL certificates, see here:
    0
  • paulapatrice
    @JohnnyBgood In previous post I wrote: Select certificate issued by cPanel, Inc or other issuer (not self-signed) Follow the steps in my previous post to determine if a cert other than self-signed is available (see screenshot). It should have been auto-generated by cPanel when the hostname was created. If it is available, assign it to the services to replace the self-signed certs. If the only certificates available are self-signed (make sure you scrolled all the way to the bottom of the list) then a new one will need to be generated.
    0
  • dnk1986
    Hi, I'm getting this same warning email daily. Is there a method to solve this?
    0
  • cPRex Jurassic Moderator
    @dnk1986 - the email notification is just letting you know that an AutoSSL certificated couldn't be issued for the domain in question. The notice should be including the domain name, so you'd need to do some troubleshooting on the domain's DNS to see why the AutoSSL system isn't working well.
    0
  • T1531
    I have been having this issue for several months (since moving servers) and am trying to address it now because the daily emails about it are annoying. For me, the domain name mentioned the email is the hostname. I do have an A Record set up for the hostname in the DNS settings of the domain (in my domain provider's account), however I can't ping the hostname from my computer. Is this a DNS issue with the hostname? And if so, do I need an additional record or is my A Record wrong somehow?
    0
  • cPRex Jurassic Moderator
    @T1531 - this does sound like a DNS issue if you aren't able to ping the hostname from your local system. If that ping doesn't work, that would explain why the AutoSSL can't be issued. I'd do some DNS testing with the hostname and see if you're able to track it down. Once the hostname is resolving properly, which you mention is controlled by the provider's nameservers, I would expect AutoSSL to work.
    0
  • T1531
    @T1531 - this does sound like a DNS issue if you aren't able to ping the hostname from your local system. If that ping doesn't work, that would explain why the AutoSSL can't be issued. I'd do some DNS testing with the hostname and see if you're able to track it down. Once the hostname is resolving properly, which you mention is controlled by the provider's nameservers, I would expect AutoSSL to work.

    Thanks, I added a CNAME Record for the hostname (in addition to the A Record) and it seems to be working now.
    0
  • cPRex Jurassic Moderator
    Great - I'm glad that's all it ended up being!
    0
  • Pine_tree
    Great - I'm glad that's all it ended up being!

    I am having the same issue. I added the A name record, but I cannot figure out what to add for the cname record. What should the name and cname values be? (sorry I'm just getting my feet wet with this type of stuff)
    0
  • cPRex Jurassic Moderator
    @Pine_tree - are you getting the same AutoSSL error? The previous user's fix may not apply to your situation - is this for a domain name or for the server's hostname?
    0
  • paulapatrice
    Hi, I'm getting this same warning email daily. Is there a method to solve this?

    I posted the solution on Post #6 above ^
    0
  • paulapatrice
    I am having the same issue. I added the A name record, but I cannot figure out what to add for the cname record. What should the name and cname values be? (sorry I'm just getting my feet wet with this type of stuff)

    The only CNAME record you need is Name = www and Value = @ It's the A record that is important, where Name = subdomain and Value = Server IP
    0
  • Pine_tree
    @Pine_tree - are you getting the same AutoSSL error? The previous user's fix may not apply to your situation - is this for a domain name or for the server's hostname?

    No the AutoSSL is running with no errors. It's for the server's hostname. Along with the emails, I ran the checkallsslcerts script and am getting this output: "Attempting DNS DCV preflight check " FAILED: The DNS DCV check (server.example.com IN CNAME) did not return the expected value (.....example.com). Attempting HTTP DCV preflight check " FAILED: Cpanel::Exception/(XID ebyehs) The system queried for a temporary file at ", which was redirected from ". The web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist."
    0
  • Pine_tree
    The only CNAME record you need is Name = www and Value = @ It's the A record that is important, where Name = subdomain and Value = Server IP

    I have the A record with Name = server.example.com and Value = Server IP. There is a CNAME record already with the Name = www.example.com. and Value = example.com Is this correct? Do I need to refresh/restart any services to implement the change?
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post