My domain is: *.stoppredatorygambling.org
I ran this command: Run AutoSSL
It produced this output: DNS DCV: No local authority: “*.stoppredatorygambling.org”
My web server is (include version): I don't know the answer to this.
The operating system my web server runs on is (include version): Windows 11 Pro
My hosting provider, if applicable, is: Bluehost
I can login to a root shell on my machine (yes or no, or I don't know): I don't know
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Yes, cPanel 118.0.70
I have attempted multiple fixes and reruns of AutoSSL, but cannot figure out why this widlcard cert will no renew, or hasn't for years apparently. Any help would be appreciated.
Can you say more about why you're trying to get a wildcard certificate in the first place? In general they'd only be needed if you had a lot of subdomains and/or had a wildcard DNS entry, but if you're just using shared hosting and their control panel I don't know why you'd need one (or what you'd do with one). Are you actually experiencing any problems, or just seeing an error in your control panel? It might be that you just need to uncheck some setting to request it if you don't actually need it.
Hi, thank you!
As of right now, users on Firefox are being stopped when trying to access the site, and this wildcard cert seems to be the only one that is giving me problems. If I am mistaken and should be looking elsewhere, please let me know.
This is the error msg on Firefox: SEC_ERROR_EXPIRED_CERTIFICATE
I still don't understand why you'd be wanting to get or use a wildcard certificate, though. You should be able to use a non-wildcard one fine. I'm not familiar with AutoSSL or cPanel myself, though, so you may need to wait for someone else here who is, or maybe try contacting your hosting provider.
I'm thinking the wildcard certificate was created (not sure why) before I was around and working with this domain. If you couldn't already tell, I'm pretty unfamiliar with all of this and am just trying to follow up with the message it gave me on the expired certificate, hoping that fixes my problem. Thanks for the help, regardless.
What is the URL they are using? Because I see certs for many subdomains of that domain. Most of those were issued by DigiCert but one wildcard from Let's Encrypt.
If it's just the "main" site stoppredatorygambling.org then I think your DNS for that needs adjusting. You should contact the hosting company.
The DNS lists two different IP addresses as A records. These two IP return different results. One uses a cert that expired in 2018 and the other is recent. Neither is that wildcard cert though
That is, sometimes I see this cert:
openssl s_client -connect stoppredatorygambling.org:443
Subject: CN=stoppredatorygambling.org
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=UbiquiTLS™ DV RSA Server CA
Validity
Not Before: Dec 1 00:00:00 2017 GMT
Not After : Mar 1 23:59:59 2018 GMT
X509v3 Subject Alternative Name:
DNS: stoppredatorygambling.org
DNS: www.stoppredatorygambling.org
And other times this one.
Subject: CN=www.stoppredatorygambling.org
Issuer: C=US, O=Let's Encrypt, CN=YR1
Validity
Not Before: Jun 28 03:11:31 2026 GMT
Not After : Sep 26 03:11:30 2026 GMT
(numerous domain names in the SAN list are omitted for brevity)
These are the two IP addresses in your DNS for both the apex domain and its www subdomain. I did not check which one produced which result but one is likely "wrong" 
A 45.60.96.158
A 162.241.217.198
I think the 162 address is the actual BlueHost origin IP. The 45 address appears to be part of Imperva, a Cloud WAF. My guess is that someone was trying to put the WAF in front of the site and added the Imperva IP but forgot to remove the BlueHost IP from DNS.
But the 45.60.96.158 IP is the one with the expired cert. Just removing the other IP from DNS won't fix the faulty cert problem.
Thank you everyone for all your investigations, I really appreciate it. Would my action item be to remove the 45.60.96.158 IP from the DNS? If not, I am happy to try to provide more information.
Well, only you know which IP (or IPs) are correct for your server setup. Sometimes multiple IP is the correct setup like with load balancers or CDNs. But, based on @rmbolger finding about these IP being for completely different services you should probably have just one.
Now, maybe the "45" IP is correct but for some reason is using a cert that expired in 2018. In that case deleting the other IP and fixing this cert is the way to go.
Or, maybe the "45" IP got there by accident in which case it should be removed.
That all said, if you delete the "45" IP I think you'll find connections to your domain work properly. However, if the "45" is a firewall and that is supposed to be working then you should correct your setup by working with your hosting service. You should probably talk to them anyway because that is part of what you pay them for
Hi all. I talked to Bluehost support and this was the response:
"Previously, we had the Sitelock website security tool, which has been discontinued and replaced by the new Malware Protection tool
Domains that were using the SiteLock CDN, DNS was not automatically changed back to the hosting IP address after the Migration to the Malware Protection tool. As a result, the SiteLock CDN remains active, leading to SSL errors."
So the "45" IP was indeed unnecessary and was deleted by Bluehost, in case anyone else has this problem.
Thank you everyone for the support!