AutoSSL renews certificates automatically, so when one fails it is nearly always because the validation check could not complete. Start with SSL/TLS Status in cPanel, which usually names the reason.
The common causes
The domain does not point at this server
This is by far the most frequent. If you have moved a domain elsewhere, or the DNS was changed, Let's Encrypt cannot validate it here and will not issue. Either point the domain back, or exclude it from AutoSSL.
A redirect in the way
Validation works by fetching a file from /.well-known/acme-challenge/ over plain http. If your .htaccess redirects everything to another domain, or forces https before that path is reached, the check fails. Exclude that folder from your redirect rules.
Cloudflare or another proxy in front
If the domain is proxied, the validation request may never reach this server. Pausing the proxy briefly, or using DNS validation, resolves it.
A subdomain that does not exist any more
An old subdomain still configured in cPanel but no longer in DNS will fail validation and can hold up the whole account. Removing it clears the error.
Password protection or an IP block
Directory protection or a firewall rule covering the site root will block the check as well.
If the reason is not obvious from the SSL/TLS Status screen, open a ticket with the domain name and we will look at the AutoSSL log for you.
