Skip to main content

SSL certificate for hostname was replaced with self-signed one and now browser showing SSL warning

Optimizr

I have been getting about SSL certificate expiration warning for Service SSL Certificates. I have searched in the cPanel forum and found posts saying that I can ignore those warning emails since SSL will be automatically replace with the new one.

It, in fact, did but with a self-signed one. So now, when I go to my whm login page, I got SSL warning.

 

I tried to run this command "/usr/local/cpanel/bin/checkallsslcerts" multiple times but I got the same email as below 

 

Here is the terminal output of that command

❯ /usr/local/cpanel/bin/checkallsslcerts
The system will check for the certificate for the “cpanel” service.
The system will attempt to replace the self-signed certificate for the “cpanel” service with a signed certificate from the cPanel Store.
The system will attempt to install a certificate for the “cpanel” service from the system ssl storage.
None of the certificates in the system ssl storage were acceptable to use for the “cpanel” service.
The system will attempt to install a certificate for the “cpanel” service from the cPanel store.
Setting up HTTP DCV (/var/www/html/.well-known/pki-validation/330B37185BEAF71AAE2AC86B0E741340.txt) …
… complete.
This server does not control “vps-2c4933c7.vps.hosting.provided”. DNS DCV is impossible for this domain.
Setting up DNS DCV for “cloud.myhostname.org” …
… complete.
 
Attempting DNS DCV preflight checks …
cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
www.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
mail.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
cpanel.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
webmail.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
whm.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
cpcalendars.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
cpcontacts.cloud.myhostname.org: DNS DCV preflight check failed; falling back to HTTP …
vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
The system failed to fetch the DCV (Domain Control Validation) file at “http://vps-2c4933c7.vps.hosting.provided/.well-known/pki-validation/330B37185BEAF71AAE2AC86B0E741340.txt” because of an error: The system failed to send an HTTP (Hypertext Transfer Protocol) “GET” request to “http://vps-2c4933c7.vps.hosting.provided/.well-known/pki-validation/330B37185BEAF71AAE2AC86B0E741340.txt” because of an error: Could not connect to 'vps-2c4933c7.vps.hosting.provided:80': Network is unreachable. The domain “vps-2c4933c7.vps.hosting.provided” resolved to an IP address “2402:1f00:8000:0800:0000:0000:0000:2e63” that does not exist on this server.
www.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“www.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
whm.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“whm.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
cloud.myhostname.org: Attempting HTTP DCV preflight check …
The system failed to fetch the DCV (Domain Control Validation) file at “http://cloud.myhostname.org/.well-known/pki-validation/330B37185BEAF71AAE2AC86B0E741340.txt” because of an error (cached): Could not connect to '2402:1f00:8000:0800:0000:0000:0000:2e63:80': Network is unreachable.
mail.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“mail.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
cpanel.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“cpanel.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
webmail.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“webmail.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
www.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“www.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
whm.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“whm.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
mail.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“mail.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
cpcontacts.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“cpcontacts.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
cpanel.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“cpanel.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
cpcalendars.vps-2c4933c7.vps.hosting.provided: Attempting HTTP DCV preflight check …
“cpcalendars.vps-2c4933c7.vps.hosting.provided” does not resolve to any IP addresses on the internet.
webmail.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“webmail.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
cpcontacts.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“cpcontacts.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
cpcalendars.cloud.myhostname.org: Attempting HTTP DCV preflight check …
“cpcalendars.cloud.myhostname.org” does not resolve to any IP addresses on the internet.
Undoing HTTP DCV setup …
… complete.
Undoing DNS DCV setup …
… complete.
[WARN] The system failed to acquire a signed certificate from the cPanel Store because of the following error: All HTTP and DNS DCV preflight checks failed!
 
The system will check for the certificate for the “dovecot” service.
The system will attempt to replace the self-signed certificate for the “dovecot” service with a signed certificate from the cPanel Store.
The system will attempt to install a certificate for the “dovecot” service from the system ssl storage.
None of the certificates in the system ssl storage were acceptable to use for the “dovecot” service.
The system will check for the certificate for the “exim” service.
The system will attempt to replace the self-signed certificate for the “exim” service with a signed certificate from the cPanel Store.
The system will attempt to install a certificate for the “exim” service from the system ssl storage.
None of the certificates in the system ssl storage were acceptable to use for the “exim” service.
 
How should I fix this?

Comments

7 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  If you create a file inside the /var/www/html/.well-known/pki-validation directory, are you able to access that in the web browser normally?  You could just create a page named text.txt and access it at your.hostnam.com/test.txt to test this.

    If that doesn't work, that would lead to the AutoSSL you're receiving.

    0
  • Optimizr

    Hi,

    Thanks for your reply.

    First of all, this is not about a cPanel account's SSL; it is about WHM Service SSL.

    There are 2 hostnames for my server.

    One is provided by hosting before setting my custom hostname using WHM's Change Hostname interface. Let's say "vps-2c4933c7.vps.hosting.provided".

    Another one is my custom hostname, set by me using the mentioned interface. Let's say "cloud.myhostname.org".

    Now I have logged into my server as root and created a "test.txt" file at /var/www/html/.well-known/pki-validation/test.txt and when I go to both of the following links, I get an SSL warning, but I can see the content of the text file.

    https://vps-2c4933c7.vps.hosting.provided/.well-known/pki-validation/test.txt
    https://cloud.myhostname.org/.well-known/pki-validation/test.txt

    What's next?

    0
  • cPRex Jurassic Moderator

    Thanks for the additional details.  Those are all good signs, and what we want to see.

    What happens if you run this, using the hostname of the server?

    /scripts/cpdig your.hostname.com A

    Does that return the correct IP address for the hostname of the machine?

    0
  • Optimizr

    Yes, it returns the IP address of the server. By the way, this is not the first time getting the SSL for the hostname. I was able to install cPanel-signed SSL for the first year. This is renewing for another year, and the problem occurs this time.

    0
  • cPRex Jurassic Moderator

    At this point it's likely best to create a ticket with either us or your host to have us take a look, as those whole process should be seamless for end users.

    0
  • MilesWeb

    It appears that there is a DNS issue with your hostnames, as indicated by the error. I have confirmed that the A records for the hostnames are not reflecting as depicted in the provided screenshots:

    1. Screenshot 1
    2. Screenshot 2

    The SSL renewal is being hindered by this DNS issue. I recommend contacting your hosting provider to address and rectify the DNS issue. Once the DNS is resolved, attempt to renew the SSL, and it should be successfully installed.

    0
  • Optimizr

    Thank you for your input but those are not actual hostnames. I have replaced them with dummy ones

    1

Please sign in to leave a comment.

Didn't find what you were looking for?

New post