If aaPanel's Let's Encrypt certificate for your WordPress site has stopped renewing — your browser is showing "Not Secure," the padlock warning, or aaPanel itself displays a renewal error — this is almost always one of four specific causes, not a broken Let's Encrypt account. Work through them in order below; most sites are fixed by the first two.

Symptoms

  • Browser shows "Not Secure" or a certificate expiry warning on a site that had a valid SSL certificate before.
  • aaPanel's SSL panel shows the certificate as expired, or a red "renewal failed" status next to the domain.
  • The certificate's "valid until" date hasn't moved in 90+ days, meaning the automatic renewal never ran.
  • Manually clicking "Renew" in aaPanel appears to work, then fails silently or reverts within a day.

Likely causes, in order of how often they actually happen

  1. Cloudflare (or another proxy) is intercepting the HTTP-01 challenge. If your domain is proxied (orange cloud) through Cloudflare, aaPanel's Let's Encrypt validation request to port 80 never reaches your server — Cloudflare answers it instead.
  2. aaPanel's renewal cron task silently stopped after a panel update. aaPanel schedules automatic renewal as an internal cron task; panel upgrades have been reported to reset or drop this task without any visible error.
  3. The site's document root or domain binding changed (a migration, a domain rename, or switching from HTTP to a different site config) without aaPanel's SSL config being updated to match, so the validation file can't be found at the expected path.
  4. Let's Encrypt rate limits — if renewal was attempted repeatedly while cause #1 or #3 was still unresolved, you may have hit Let's Encrypt's weekly rate limit for that domain, which blocks further attempts for several days regardless of what you fix.

Fix it: lowest-risk steps first

Step 1 — Confirm whether Cloudflare (or any proxy) is involved

In your Cloudflare DNS dashboard, check the cloud icon next to your domain's A record.

  • If it's orange (proxied): temporarily click it to grey (DNS only) for the domain, wait 2–3 minutes for DNS to settle, then retry the renewal in aaPanel (Website → SSL → your domain → Renew). Once the certificate renews successfully, you can safely turn the orange cloud back on — the renewal only needs direct access during the actual validation request.
  • If it's already grey, or you're not using Cloudflare: skip to Step 2.

This single step resolves the majority of aaPanel renewal failures on WordPress sites, because most site owners add Cloudflare after initially setting up SSL and don't realize it affects future renewals.

Step 2 — Check aaPanel's renewal cron task actually exists

In aaPanel, go to Cron (left sidebar) and look for a task related to SSL/certificate renewal. If you don't see one, or it's disabled:

  1. Go back to Website → SSL for the affected domain.
  2. Re-issue the certificate manually (Let's Encrypt → apply). This re-creates the underlying renewal task as a side effect.
  3. Confirm afterward that a corresponding entry now appears under Cron.

Do this even if the manual renewal in Step 1 already worked — otherwise the certificate will just fail silently again in 90 days.

Step 3 — Verify the domain's document root matches what SSL is checking

Go to Website → your site → Site Directory, and confirm the path shown matches what's set under SSL for the same domain. If you migrated the site, renamed the domain, or moved it to a new folder at any point, these can drift out of sync. Re-select the correct directory in the SSL settings and retry the renewal.

Step 4 — Only if the above didn't work: check for a Let's Encrypt rate limit

If aaPanel's error message mentions "too many certificates" or "rate limit," you've likely hit Let's Encrypt's weekly limit for that exact domain after repeated failed attempts. There's no way to bypass this — wait 7 days after your last failed attempt, then retry Steps 1–3 first so the retry actually succeeds.

Verify the fix

  1. In aaPanel, confirm the SSL panel shows a new "valid until" date roughly 90 days out.
  2. Visit your site in an incognito/private browser window and confirm the padlock shows a valid certificate with no warnings.
  3. Check Cron again a few days later to confirm the renewal task is still present and hasn't been silently removed.

If you need to roll back

If a renewal attempt breaks HTTPS entirely (site becomes unreachable over https://), aaPanel keeps the previous certificate files until a new one is successfully issued — switching SSL off temporarily under Website → SSL → Disable will let visitors reach the site over plain HTTP while you retry, without needing to restore your backup. Only restore from the backup you took earlier if site files themselves were affected, which is rare for an SSL-only issue.

Related fixes

FAQ

Does turning off Cloudflare's proxy affect my site's speed or security during renewal?

Only briefly. While the domain is set to "DNS only," your visitors connect directly to your server instead of through Cloudflare's network, so you temporarily lose Cloudflare's caching and firewall for that domain. For the few minutes it takes to renew a certificate, this is a safe, standard trade-off — re-enable the proxy immediately after.

Can I avoid this happening again every 90 days?

Yes — once Steps 1 and 2 are both confirmed (DNS-only during renewal windows isn't required going forward if the cron task is healthy; Let's Encrypt's HTTP-01 challenge only needs direct access at the moment of renewal, and aaPanel handles that automatically as long as the cron task exists). The real fix is making sure the cron task in Step 2 exists — that's what prevents the recurring failure.

Should I switch to Cloudflare's own SSL instead of aaPanel's Let's Encrypt certificate?

That's a valid alternative (Cloudflare can issue and manage its own edge certificate), but it changes your SSL/TLS mode setup and is a separate decision from fixing the current renewal failure — don't combine both changes in the same session, so you can tell which one fixed the problem.