Work through these in order.
1. THE DOMAIN DOES NOT RESOLVE HERE
AutoSSL validates by retrieving a file from your site. If the domain points at another host, or nowhere, validation cannot succeed.
Check with a DNS lookup that the domain returns our server's address.
2. A PROXY IS IN THE WAY
Cloudflare in proxied mode can prevent validation. Set the record to DNS-only, issue the certificate, then re-enable proxying if you wish.
3. A REDIRECT IS INTERCEPTING VALIDATION
A rule redirecting everything, including the /.well-known/ path, prevents the authority retrieving the file. Exclude that path from redirects.
4. THE SUBDOMAIN DOES NOT EXIST IN DNS
A subdomain created in cPanel but with no DNS record cannot be validated.
5. THE DOMAIN IS EXCLUDED
Check SSL/TLS Status for domains marked as excluded, and include them.
6. DNS HAS NOT PROPAGATED
After pointing a domain, wait for propagation before running AutoSSL.
THE FASTEST DIAGNOSIS
Click the domain name on the SSL/TLS Status page. cPanel states the specific reason.
