Unable to install SSL for autodiscover with Let's Encrypt

Nermin

• December 29, 2021 00:48

Hello, I am receiving email from my server every day regarding inability to install SSL for autodiscover for all of my domains (150 domains on server). I have posted error for one of accounts, but all of them get the same error. This is the error log:

uwbgroup.ba: AutoSSL would normally renew this certificate now, but 1 of the website"s secured domains just failed DCV. To provide you with more time to resolve this problem, AutoSSL will defer the renewal until Jan 7, 2022 at 1:57:50 AM UTC. After that time, AutoSSL will request a replacement certificate that excludes any domains that fail DCV. At the time of this notice, the certificate will expire in 11 days, 19 hours, 21 minutes, and 56 seconds.

AutoSSL did not renew the certificate for "uwbgroup.ba". You must take action to keep this site secure. The "LetsEncrypt" AutoSSL provider could not renew the SSL certificate without a reduction of coverage because of the following problem: ? autodiscover.uwbgroup.ba (checked on Dec 29, 2021 at 6:35:48 AM UTC) DNS DCV: No local authority: "autodiscover.uwbgroup.ba"; HTTP DCV: The system queried for a temporary file at ", which was redirected from ". The web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist. For the most current status, navigate to the " Expiration: Monday, January 10, 2022 at 1:57:50 AM UTC Domain Names: autodiscover.uwbgroup.ba cpanel.uwbgroup.ba cpcalendars.uwbgroup.ba cpcontacts.uwbgroup.ba mail.uwbgroup.ba uwbgroup.ba webdisk.uwbgroup.ba webmail.uwbgroup.ba 7:43:43 AM AutoSSL"s configured provider is "Let"s Encrypt"". Analyzing "uwbgroup""s domains " 7:45:43 AM Analyzing "uwbgroup.ba" (website) " 7:45:43 AM TLS Status: Ready for Renewal WARN Certificate expiry: 1/10/22, 1:57 AM UTC (11.8 days from now) 7:45:43 AM Attempting to ensure the existence of necessary CAA records " 7:45:44 AM No CAA records were created. 7:45:44 AM Verifying 10 domains" management status " Verifying "Let"s Encrypt"s authorization on 10 domains via DNS CAA records " 7:45:44 AM "webdisk.uwbgroup.ba" is managed. "cpanel.uwbgroup.ba" is managed. "mail.uwbgroup.ba" is managed. "www.uwbgroup.ba" is managed. "uwbgroup.ba" is managed. "webmail.uwbgroup.ba" is managed. "cpcontacts.uwbgroup.ba" is managed. "cpcalendars.uwbgroup.ba" is managed. "autodiscover.uwbgroup.ba" is managed. "*.uwbgroup.ba" is managed. All of this user"s 10 domains are managed. CA authorized: "uwbgroup.ba" CA authorized: "*.uwbgroup.ba" CA authorized: "autodiscover.uwbgroup.ba" CA authorized: "mail.uwbgroup.ba" CA authorized: "cpcontacts.uwbgroup.ba" CA authorized: "cpcalendars.uwbgroup.ba" CA authorized: "webmail.uwbgroup.ba" CA authorized: "www.uwbgroup.ba" CA authorized: "cpanel.uwbgroup.ba" 7:45:45 AM CA authorized: "webdisk.uwbgroup.ba" "Let"s Encrypt"" is authorized to issue certificates for 10 of this user"s 10 domains. 7:45:45 AM Performing HTTP DCV (Domain Control Validation) on 9 domains " 7:45:46 AM Redirection #1 (cpanel.uwbgroup.ba): Redirection #1 (webdisk.uwbgroup.ba): Redirection #1 (webmail.uwbgroup.ba): Redirection #1 (cpcontacts.uwbgroup.ba): Redirection #1 (cpcalendars.uwbgroup.ba): Redirection #1 (autodiscover.uwbgroup.ba): Local HTTP DCV OK: uwbgroup.ba Local HTTP DCV OK: , which was redirected from ". The web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist. 7:45:46 AM Verifying local authority for 2 domains " 7:45:46 AM No local authority: "autodiscover.uwbgroup.ba" No local authority: "*.uwbgroup.ba" 7:45:46 AM No local DNS DCV is necessary. 7:45:46 AM Processing "uwbgroup""s local DCV results " 7:45:46 AM Analyzing "uwbgroup.ba""s DCV results " 7:45:46 AM ERROR Impediment: SECURED_DOMAIN_DCV_FAILURE: One or more currently-secured domains failed DCV. 7:45:46 AM The system has completed "uwbgroup""s AutoSSL check. It used to work flawlessly but now it does not for some reason. Thank you! Nermin

• 

  andrew.n

  • December 29, 2021 07:20

  Does autodiscover.uwbgroup.ba exists as a subdomain? If you place some files under this subdomain manually are you able to access them? In most of the cases some rules in .htaccess file prevents the files to be reached correctly.

  0
• 

  Nermin

  • December 29, 2021 08:07

  I have created autodiscover.uwbgroup.ba subdomain and put test.html in it and I can access them. Link: AddHandler application/x-httpd-ea-php73 .php .php7 .phtml # php -- END cPanel-generated handler, do not edit # BEGIN cPanel-generated php ini directives, do not edit # Manual editing of this file may result in unexpected behavior. # To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor) # For more information, read our documentation (PHP Home - EasyApache 4 - cPanel Documentation) php_flag display_errors Off php_value max_execution_time 90 php_value max_input_time 180 php_value max_input_vars 5000 php_value memory_limit 256M php_value post_max_size 51M php_value session.gc_maxlifetime 1440 php_value session.save_path "/var/cpanel/php/sessions/ea-php73" php_value upload_max_filesize 50M php_flag zlib.output_compression Off php_flag display_errors Off php_value max_execution_time 90 php_value max_input_time 180 php_value max_input_vars 5000 php_value memory_limit 256M php_value post_max_size 51M php_value session.gc_maxlifetime 1440 php_value session.save_path "/var/cpanel/php/sessions/ea-php73" php_value upload_max_filesize 50M php_flag zlib.output_compression Off # END cPanel-generated php ini directives, do not edit END of htaccess file. Thank you!

  0
• 

  andrew.n

  • December 29, 2021 11:05

  Try to rename your htaccess file and see if you can manually renew the SSL certificate now.

  0
• 

  Nermin

  • January 03, 2022 11:46

  Try to rename your htaccess file and see if you can manually renew the SSL certificate now.

  
  I have renamed htaccess and same problem occurs. All accounts have this issue. Cca 120 accounts have this issue, some of them are on Cloudfare (10 accouts), a few of them are Joomla CMS and 90% are Wordpress.

  0
• 

  andrew.n

  • January 03, 2022 15:39

  and are those subdomains responding? do they have the right A records pointing to the server?

  0
• 

  Nermin

  • January 05, 2022 05:48

  Yes they have. Let's Encrypt was installing SSL just fine for years, until three months ago. If I create subdomain autodiscover in cPanel it will install SSL for it, but without creating subdomain it does not install. And by default cPanel will create DNS for cpanel, webmail, webdisk, cpcalendars, cpcontacts, autodiscover. It installs SSL for cpanel, webmail, webdisk, cpcalendars, cpcontacts but for autodiscover it will not install.

  0
• 

  andrew.n

  • January 06, 2022 16:58

  and if you remove the current certificate from that domain name and issue a new one will that install correctly? I think I had the same issue earlier and I was told that manual renewal of those certificates won't work but AutoSSL will renew them fine automatically shortly before the expiration date (in 72 hours).

  0
• 

  Nermin

  • January 06, 2022 19:32

  I have removed current certficate, and tried to install a new one. It installs everything but autodiscover.domain.com. Here is log: DNS DCV: No local authority: "autodiscover.kancelarijski.ba"; HTTP DCV: The system queried for a temporary file at ", which was redirected from ". The web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist. Other domains on server, before SSL expiraton, will install SLL for all subdomains but not for autodiscover with same error for all accounts

  0
• 

  Nermin

  • January 06, 2022 20:53

  I have disabled "Thunderbird and Outlook autodiscover and autoconfig support (enables service subdomain and SRV record creation) " and it is gone

  0
• 

  andrew.n

  • January 07, 2022 11:11

  Maybe it is worth to

  0
• 

  cPanelAnthony

  • January 12, 2022 17:27

  Hello! A ticket would be helpful; can you open one using the link in my signature and provide me with the ticket ID?

  0

Please sign in to leave a comment.