AutoSSL notice: the renewal may reduce coverage

AutoSSL sends the notice The AutoSSL certificate renewal may cause a reduction of coverage when the current certificate includes one or more names that have not passed domain control validation. If the problem persists at renewal, the new certificate may be issued without those names.

Identify what is happening

Open SSL/TLS Status in cPanel and find the domain flagged with problems. Then check:

1. That the domain or subdomain is still in use and should be covered.
2. That its A and AAAA records point to the hosting server. An old AAAA record can prevent validation even if the A record is correct.
3. That no proxy or CDN is serving a different configuration during validation.
4. That the name shows as Included and is not excluded from AutoSSL.

If DNS has just been changed, wait until it is public. If your version offers Run AutoSSL, run it once; if it does not appear, ask us to review the run and its errors. The task checks the whole account and may take a while; the fact that it has started does not mean the certificate has been issued, so check the status again when it finishes.

Fix or exclude

If the domain should point to the hosting, first fix the DNS or include it in AutoSSL again. If it is no longer used or has been moved, check which service manages its certificate before excluding it. In versions that no longer offer the exclude button, contact us. A proxy may also need a valid certificate on the origin server: the fact that it has its own public certificate is not enough to exclude the hosting's.

Do not exclude an active domain just to hide the notice: AutoSSL will stop renewing it and the installed certificate will eventually expire. If the domain should be covered and the status does not explain the failure, contact us with the affected name so we can check the validation and the certificate being served publicly.

Include in your ticket the exact name that fails, the error text and the expiry date shown in the status. A certificate can include several names: the main domain working does not prove that a subdomain will be covered in the next issuance.