SSL renew urgent

Help
1

Subject: AutoSSL renewal failing on cPanel/123-reg hosting for ai-qs.io

Hi,
We're trying to renew a Let's Encrypt certificate for ai-qs.io and www.ai-qs.io, hosted on 123-reg (cPanel). The certificate expired on 4th August 2026.

We've attempted to trigger a renewal via cPanel's AutoSSL feature, but it isn't completing successfully — the certificate manager still shows the old expired cert and prompts us to "request a replacement from the issuer."

Could someone help us understand:
Whether there's a known issue on Let's Encrypt's side affecting renewals right now
Any common causes we should check (CAA records, rate limits, validation failures) given the symptoms above
Domain: ai-qs.io
Hosting: 123-reg shared hosting (cPanel)

Thanks in advance for any pointers.

2

do you get a more verbose error message from cpanel?

3

No. Known problems are posted at https://letsencrypt.status.io/.

If all you have is shared hosting, and your control panel isn't giving you a helpful meaningful error, probably the best thing to do is to contact your hosting provider. That's in theory what you're paying them for.

4

See the error attached. It cannot let me renew SSL from the cpanel.

IMG-20260805-WA0148
IMG-20260805-WA01481599×899 113 KB

5

So that shows you that your current certificate is expired, but it doesn't show anything about the process of it trying to acquire a new certificate. I'm not familiar with cPanel, but I'm guessing it's on some other page.

Again, if all you have is shared hosting, contact your hoster. There isn't anything anybody else can do to fix it for you.

6

FYI: Please be careful to never post screenshots or copies of a private key, even a partial one.

The first line is usually not enough to be a problem, but any more could require revocation.

7

Slightly offtopic, but does LE allow expired certs to be revoked with the applicable revocation reason? I seem to have the vague memory of that expired certs couldn't be revoked, but that would be necessary if one needs to block the leaked private key..

8

No, the Let's Encrypt API will only revoke unexpired certificates. So, in order to block future issuance for a compromised private key that doesn't correspond to any unexpired certificates, you'd need to issue a test cert and then immediately revoke it.

You can, though, re-revoke an already revoked (but unexpired) certificate with the keyCompromise reason code.

9

To debug the autossl problem you need the logs:
https://support.cpanel.net/hc/en-us/articles/360048523694-Where-are-AutoSSL-logs-stored

However as this is shared hosting maybe you don't have that access? In which case you would need to either escalate with your hosting provider.

10

@JamesLE Are you getting a feed from https://pwnedkeys.com/ by any chance?

11

They may (and are welcome to) use our API to revoke when they become aware of a new compromised key. Our volume would make it prohibitive to query their API for every issuance.

12

pwnedkeys allow register a key as pwned without having to giving private key itself to them by signing jws message This key is pwned! See https://pwnedkeys.com for more info. with that key, so it's unlikely they will able to use LE's revocation API because to revoke it needs to sign a new jws with that private key.