Skip to main content

problems with autossl_check, checkallsslcerts and digicert.com

bloatedstoat

Hello,

Since Weds 3rd June we've noticed that there are issues contacting ocsp.digicert.com from two servers that use a wildcard certificate we bought to secure cpanel services. The certificate expires in October this year. I thought it would resolve itself but, alas, no.

The two servers are on entirely different networks and the certificate has been installed on each

The certificate runs on a main server and a DNS Only server, both are having trouble reaching digicert.

I've run some tests and both our local DNS lookups match with public DNS and pings to the IPs below work fine.

# dig A +short ocsp.digicert.com
ocsp.edge.digicert.com.
ocsp.digicert.com.cdn.cloudflare.net.
162.159.142.9
172.66.2.5


Curl "get" works but appreciate the error report is from using post.

# curl -I http://ocsp.digicert.com:80
HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2026 18:33:23 GMT
ETag: "69c2d8f3-267"
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
Cache-Control: max-age=722
Date: Fri, 05 Jun 2026 08:20:00 GMT
Connection: keep-alive

We have CSF on each server (main and DNS Only) and port 80 is open outbound.

The error we're seeing consistently is:

Server 1:
[2026-06-05 11:42:05 +1000]
warn [autossl_check] Cpanel::Exception::HTTP::Network/(XID zxgda6)
The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable

Server 2: DNS Only.
[2026-06-05 12:42:57 +1000] warn [checkallsslcerts] Retrying after network failure: (XID rd25qv) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
[2026-06-05 12:42:57 +1000] warn [checkallsslcerts] Cpanel::Exception::HTTP::Network/(XID 2a7kb6) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable

The feedback from DigiCert support is this:

This seems to be an issue on your network not being able to reach ocsp.digicert.com server.
Because this is a DNS only server could you please make sure that there is no restrictions on the outbound access. Also check your firewall if there is any block on the outbound port 80
So it is possible you have something on you network blocking it, as it works fine for me and other testing it.

Stand out for me is that we have several servers on totally different networks experiencing the same behaviour.

One final thought: The certificate we bought was from a new provider and not the previous provider, the old certificate expired on the same day the errors started, although we removed the old certificate from both servers. Coincidence.

Would you have any ideas as to why we're receiving this error? Is it possible to debug this further?

I'm heeding the advice in the online docs not to run the checkallsslcerts script unless instructed.

Cheers.

Comments

13 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  I personally don't have any thoughts on this as it doesn't sound like it's something that would be related to cPanel.

    With CSF disabled/off do you get the same thing?  If you run a traceroute to the domain or IP do you see anything interesting there?

    0
  • bloatedstoat
    • Edited

    Having dug into this more deeply here's some more detail. 

    checkallsslcerts -> Cpanel::SSL::OCSP is attempting to use IPv6 for the DigiCert OCSP endpoint when IPv6 is not configured on our DNS Only AND main server.

    Our DNS and Main Server have an IPv6 interface that is local only.

    On the DNS Only I disabled the IPv6 to test what's going on.

    IPv4 connectivity is confirmed working.

    The error is reproducible during the automated checkallsslcerts process, with repeated failures such as:

    [2026-08-10 06:39:13 +1000] warn [checkallsslcerts]
    Retrying after network failure:
    Could not connect to 'ocsp.digicert.com:80':
    Address family for hostname not supported

    The same failure is subsequently reported again when checking the Exim certificate.

    On our main server with the IPv6 interface NOT disabled the error is this:

    /usr/local/cpanel/logs/error_log:
[2026-08-09 20:42:03 +1000] warn [autossl_check] Retrying after network failure: (XID tkrd5y) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.sectigo.com” because of an error: Could not connect to 'ocsp.sectigo.com:80': Network is unreachable
[2026-08-09 20:42:03 +1000] warn [autossl_check] Cpanel::Exception::HTTP::Network/(XID 2zs2n8) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.sectigo.com” because of an error: Could not connect to 'ocsp.sectigo.com:80': Network is unreachable
[2026-08-09 20:42:05 +1000] warn [autossl_check] Retrying after network failure: (XID bmn8f4) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
[2026-08-09 20:42:05 +1000] warn [autossl_check] Cpanel::Exception::HTTP::Network/(XID v2k4zc) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable

    I'd prefer not to enable IPv6 solely to workaround this, the server currently operates correctly over IPv4.

    Is this a known issue with the current cPanel Perl HTTP stack?

    Can we force OCSP requests to use IPv4?

    Thanks.

    0
  • cPRex Jurassic Moderator

    Thanks for the additional details.  Rather than focus on the networking issue, I'm more interested in why you mention Digicert but then it shows a connection to Sectigo in the logs.  That seems odd to me as these are separate companies as far as I am aware.

    0
  • bloatedstoat
    • Edited

    Yes it does appear to be both instances - Digicert AND Sectigo. I was focused on the Digicert one but yes, both are failing.

    [2026-08-10 23:42:03 +1000] warn [autossl_check] Cpanel::Exception::HTTP::Network/(XID u8cj6b) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.sectigo.com” because of an error: Could not connect to 'ocsp.sectigo.com:80': Network is unreachable
[2026-08-10 23:42:05 +1000] warn [autossl_check] Retrying after network failure: (XID jatuqw) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
    0
  • cPRex Jurassic Moderator

    Well at least it's consistent :D

    Just to confirm, you're using a custom AutoSSL provider on this machine, correct?

    0
  • bloatedstoat
    • Edited

    We use the standard Let's Encrypt on our main server to install or renew the common or garden hosted domains' SSL certs. We use a wildcard certificate from an online outlet to secure services related to our main server hostname, the wildcard was installed within service certificate area of WHM on both our main server and DNS Only. Thanks, yes consistency is good!

    Earlier I installed and configured IPv6 on our DNS Only box's interface without modifying any DNS records and the error has since gone away. That box being DNS Only just has the wildcard cert installed.

    0
  • bloatedstoat

    If you need a touch more verbosity, the following is not present all of the time when we receive our hourly reports from LFD but pops up each day with the Digicert instance.

    [2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Retrying after network failure: (XID waazfb) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
[2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Cpanel::Exception::HTTP::Network/(XID sdeepz) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
 at /usr/local/cpanel/Cpanel/HTTP/Client.pm line 137.
	Cpanel::HTTP::Client::request(Cpanel::HTTP::Client=HASH(0x24484f8), "POST", "http://ocsp.digicert.com", HASH(0x2455b18)) called at (eval 8) line 6
	HTTP::Tiny::post(Cpanel::HTTP::Client=HASH(0x24484f8), "http://ocsp.digicert.com", HASH(0x2455b18)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 98
	Cpanel::SSL::OCSP::__ANON__() called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	eval {...} called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	Cpanel::SSL::OCSP::__ANON__(Cpanel::Exception::HTTP::Network=HASH(0x24561d8)) called at /usr/local/cpanel/Cpanel/Try.pm line 207
	eval {...} called at /usr/local/cpanel/Cpanel/Try.pm line 204
	Cpanel::Try::try(CODE(0x2448240), "Cpanel::Exception::HTTP::Network", CODE(0x2448fd8), "", CODE(0x23e77e8)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 132
	Cpanel::SSL::OCSP::cert_chain_is_revoked("http://ocsp.digicert.com", "-----BEGIN CERTIFICATE-----\x{a}MIIGSzCCBTOgAwIBAgIQBCxeM82nyCsJz"..., "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 259
	Cpanel::SSL::Objects::Certificate::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x208d698), Try::Tiny::Catch=REF(0x2041058)) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 268
	Cpanel::SSL::Objects::Certificate::revoked(Cpanel::SSL::Objects::Certificate::File=HASH(0x20415c8), "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at bin/checkallsslcerts.pl line 180
	bin::checkallsslcerts::_check_notify_and_auto_renew_cert_for_service(bin::checkallsslcerts=HASH(0x1f53480), "cpanel") called at bin/checkallsslcerts.pl line 114
	bin::checkallsslcerts::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x1fa5608), Try::Tiny::Catch=REF(0x179d798)) called at bin/checkallsslcerts.pl line 139
	bin::checkallsslcerts::run(bin::checkallsslcerts=HASH(0x1f53480)) called at bin/checkallsslcerts.pl line 76
[2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Retrying after network failure: (XID 7wranr) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
[2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Cpanel::Exception::HTTP::Network/(XID vxu4tx) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
 at /usr/local/cpanel/Cpanel/HTTP/Client.pm line 137.
	Cpanel::HTTP::Client::request(Cpanel::HTTP::Client=HASH(0x24484f8), "POST", "http://ocsp.digicert.com", HASH(0x27db480)) called at (eval 8) line 6
	HTTP::Tiny::post(Cpanel::HTTP::Client=HASH(0x24484f8), "http://ocsp.digicert.com", HASH(0x27db480)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 98
	Cpanel::SSL::OCSP::__ANON__() called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	eval {...} called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	Cpanel::SSL::OCSP::__ANON__(Cpanel::Exception::HTTP::Network=HASH(0x2041850)) called at /usr/local/cpanel/Cpanel/Try.pm line 207
	eval {...} called at /usr/local/cpanel/Cpanel/Try.pm line 204
	Cpanel::Try::try(CODE(0x208d038), "Cpanel::Exception::HTTP::Network", CODE(0x208cf00), "", CODE(0x23e77e8)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 132
	Cpanel::SSL::OCSP::cert_chain_is_revoked("http://ocsp.digicert.com", "-----BEGIN CERTIFICATE-----\x{a}MIIGSzCCBTOgAwIBAgIQBCxeM82nyCsJz"..., "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 259
	Cpanel::SSL::Objects::Certificate::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x2715550), Try::Tiny::Catch=REF(0x2574468)) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 268
	Cpanel::SSL::Objects::Certificate::revoked(Cpanel::SSL::Objects::Certificate::File=HASH(0x27618c8), "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at bin/checkallsslcerts.pl line 180
	bin::checkallsslcerts::_check_notify_and_auto_renew_cert_for_service(bin::checkallsslcerts=HASH(0x1f53480), "dovecot") called at bin/checkallsslcerts.pl line 114
	bin::checkallsslcerts::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x1fa5608), Try::Tiny::Catch=REF(0x23e7ad0)) called at bin/checkallsslcerts.pl line 139
	bin::checkallsslcerts::run(bin::checkallsslcerts=HASH(0x1f53480)) called at bin/checkallsslcerts.pl line 76
[2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Retrying after network failure: (XID 4xpje7) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
[2026-08-10 22:15:49 +1000] warn [checkallsslcerts] Cpanel::Exception::HTTP::Network/(XID 2u9f3k) The system failed to send an HTTP (Hypertext Transfer Protocol) “POST” request to “http://ocsp.digicert.com” because of an error: Could not connect to 'ocsp.digicert.com:80': Network is unreachable
 at /usr/local/cpanel/Cpanel/HTTP/Client.pm line 137.
	Cpanel::HTTP::Client::request(Cpanel::HTTP::Client=HASH(0x24484f8), "POST", "http://ocsp.digicert.com", HASH(0x27dbcf0)) called at (eval 8) line 6
	HTTP::Tiny::post(Cpanel::HTTP::Client=HASH(0x24484f8), "http://ocsp.digicert.com", HASH(0x27dbcf0)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 98
	Cpanel::SSL::OCSP::__ANON__() called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	eval {...} called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 126
	Cpanel::SSL::OCSP::__ANON__(Cpanel::Exception::HTTP::Network=HASH(0x27db4f8)) called at /usr/local/cpanel/Cpanel/Try.pm line 207
	eval {...} called at /usr/local/cpanel/Cpanel/Try.pm line 204
	Cpanel::Try::try(CODE(0x2041b38), "Cpanel::Exception::HTTP::Network", CODE(0x2041b98), "", CODE(0x23e77e8)) called at /usr/local/cpanel/Cpanel/SSL/OCSP.pm line 132
	Cpanel::SSL::OCSP::cert_chain_is_revoked("http://ocsp.digicert.com", "-----BEGIN CERTIFICATE-----\x{a}MIIGSzCCBTOgAwIBAgIQBCxeM82nyCsJz"..., "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 259
	Cpanel::SSL::Objects::Certificate::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x258fdf0), Try::Tiny::Catch=REF(0x27daee0)) called at /usr/local/cpanel/Cpanel/SSL/Objects/Certificate.pm line 268
	Cpanel::SSL::Objects::Certificate::revoked(Cpanel::SSL::Objects::Certificate::File=HASH(0x2041628), "-----BEGIN CERTIFICATE-----\x{a}MIIErjCCA5agAwIBAgIQAgH7ynFCJTr++"...) called at bin/checkallsslcerts.pl line 180
	bin::checkallsslcerts::_check_notify_and_auto_renew_cert_for_service(bin::checkallsslcerts=HASH(0x1f53480), "exim") called at bin/checkallsslcerts.pl line 114
	bin::checkallsslcerts::__ANON__() called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 100
	eval {...} called at /usr/local/cpanel/3rdparty/perl/542/cpanel-lib/Try/Tiny.pm line 91
	Try::Tiny::try(CODE(0x1fa5608), Try::Tiny::Catch=REF(0x208d110)) called at bin/checkallsslcerts.pl line 139
	bin::checkallsslcerts::run(bin::checkallsslcerts=HASH(0x1f53480)) called at bin/checkallsslcerts.pl line 76
    0
  • cPRex Jurassic Moderator

    Could you make a ticket for this one?  I honestly have no clue and I'm not finding any similar errors on our end.

    0
  • bloatedstoat

    Yep, will do. Thanks for your time, would you like me post the ticket id here?

    0
  • cPRex Jurassic Moderator

    Yes, I'd like to follow along for sure!

    0
  • bloatedstoat

    Ticket ID 96056932.

    Will post outcome here.

    Thanks for your time cpRex.

    0
  • cPRex Jurassic Moderator

    I'm following along with that now!

    0
  • bloatedstoat

    The systems that cPanel uses to perform AutoSSL lookups do so by doing recursive DNS lookups. These prioritize IPv6 records if the interface is available at all, but is not required:

    If libunbound finds that the server has an IPv6 interface it will attempt to verify using that interface, and if it fails, the AutoSSL checks will fail. We generally recommend repairing the network configuration to either ensure that IPv6 lookups can complete, or that the interface is disabled completely such that it no longer shows up when looking at your network interfaces. For example, the main server here has an IPv6 interface but lookups cannot complete - this will likely introduce issues in verifying AutoSSL lookups:

    The AutoSSL checks are not sophisticated enough to detect a failure in only IPv6 - any lookups that fail will stop the process until they can complete. If these interfaces are completely disabled, we should expect that no more lookups will occur using the interface and it will fall back to IPv4 checks only. The lookups for OCSP are performed in a similar way, and the suggested fixes are largely the same when it comes to IPv6 interfaces:

    https://support.cpanel.net/hc/en-us/articles/1500002202522-Is-IPv6-required-to-use-cPanel-WHM-and-AutoSSL

    https://support.cpanel.net/hc/en-us/articles/360036533894-OCSP-responder-errors

    Problem understood.

    Thank you.

     

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post