cPanel AutoSSL Stuck on Pending: What to Check

An AutoSSL request that remains pending is waiting on a validation or provider step. Repeatedly clicking “Run AutoSSL” may produce more requests without explaining which prerequisite is missing. Start with the affected domain and the exact status message in WHM.

Confirm the domain and DNS path

Check that the domain is assigned to the expected cPanel account and that its public DNS points to the server expected to complete validation. Review both the root name and any www name the site uses. If a proxy or CDN sits in front, confirm that it does not prevent the provider's domain-control check.

CAA records can restrict which certificate authorities may issue for a name. Check whether the current records permit the authority configured by the hosting provider. Do not remove CAA policy broadly just to make one issuance attempt succeed.

Read the provider result

Review the AutoSSL log for the specific account and hostname. Look for a failed domain-control validation, a DNS mismatch, an account limit or an external service response. Ask the hosting provider which certificate authority is configured and whether its validation endpoint is reachable from the domain.

cPanel's AutoSSL documentation describes provider and domain checks. The exact interface may differ with version and hosting permissions.

Keep the current certificate in view

Check which certificate the web server is currently serving and when it expires. A pending replacement does not necessarily mean HTTPS is already broken. Avoid deleting a working certificate or repeatedly reinstalling it before understanding the failed validation.

After correcting the underlying issue, run the provider's documented check and test the hostname from outside the server. Confirm that the served certificate matches the requested name and that the site still presents the expected content through any proxy layer.