WPFIX STACK — home
Hosting & aaPanel

aaPanel Won't Renew Your Let's Encrypt SSL? Here's Why (and the Fix)

aaPanel's Let's Encrypt certificate stuck, expired, or failing to renew? Here's exactly why it happens on WordPress sites and the safe step-by-step fix.

By Published Updated 5 min read

System with various wires managing access to centralized resource of server in data center
Photo by Brett Sayles on Pexels

If aaPanel's Let's Encrypt certificate for your WordPress site has stopped renewing — your browser is showing "Not Secure," the padlock warning, or aaPanel itself displays a renewal error — this is almost always one of four specific causes, not a broken Let's Encrypt account. Work through them in order below; most sites are fixed by the first two.

Symptoms

  • Browser shows "Not Secure" or a certificate expiry warning on a site that had a valid SSL certificate before.
  • aaPanel's SSL panel shows the certificate as expired, or a red "renewal failed" status next to the domain.
  • The certificate's "valid until" date hasn't moved in 90+ days, meaning the automatic renewal never ran.
  • Manually clicking "Renew" in aaPanel appears to work, then fails silently or reverts within a day.

Likely causes, in order of how often they actually happen

  1. Cloudflare (or another proxy) sits in front of the HTTP-01 challenge. Let's Encrypt's HTTP-01 check (opens in a new tab) fetches a file from /.well-known/acme-challenge/ on port 80 (it follows redirects, including to HTTPS). With the orange cloud on, that request goes through Cloudflare, and a redirect, a WAF or bot rule, or an SSL-mode problem between Cloudflare and your server can stop the file from being served.
  2. aaPanel's renewal cron task is missing or disabled. aaPanel renews certificates through a scheduled task; if that task was deleted, disabled or never recreated (for example after a migration or a panel reinstall), nothing renews the certificate and no error appears until it expires.
  3. The site's document root or domain binding changed (a migration, a domain rename, or switching from HTTP to a different site config) without aaPanel's SSL config being updated to match, so the validation file can't be found at the expected path.
  4. Let's Encrypt rate limits. Repeated attempts while cause #1 or #3 is unresolved can hit Let's Encrypt's limits (opens in a new tab): 5 failed validations per hostname per hour (the allowance refills about every 12 minutes), and 5 certificates for the exact same set of names per 7 days (refilling one every 34 hours).

Fix it: lowest-risk steps first

Step 1 — Confirm whether Cloudflare (or any proxy) is involved

In your Cloudflare DNS dashboard, check the cloud icon next to your domain's A record.

  • If it's orange (proxied): temporarily click it to grey (DNS only) for the domain, wait 2–3 minutes for DNS to settle, then retry the renewal in aaPanel (Website → SSL → your domain → Renew). Once the certificate renews successfully, you can safely turn the orange cloud back on — the renewal only needs direct access during the actual validation request.
  • If it's already grey, or you're not using Cloudflare: skip to Step 2.

Turning the proxy off briefly is the quickest test, and many sites stop here because Cloudflare was added after SSL was first set up. For a permanent fix that keeps the orange cloud on, validate by DNS instead of by file: DNS-01 validation (opens in a new tab) never touches port 80, and aaPanel's Let's Encrypt screen offers a DNS verification option that can use a Cloudflare API key.

Step 2 — Check aaPanel's renewal cron task actually exists

In aaPanel, go to Cron (left sidebar) and look for a task related to SSL/certificate renewal. If you don't see one, or it's disabled:

  1. Go back to Website → SSL for the affected domain.
  2. Re-issue the certificate manually (Let's Encrypt → apply). This re-creates the underlying renewal task as a side effect.
  3. Confirm afterward that a corresponding entry now appears under Cron.

Do this even if the manual renewal in Step 1 already worked — otherwise the certificate will just fail silently again in 90 days.

Step 3 — Verify the domain's document root matches what SSL is checking

Go to Website → your site → Site Directory, and confirm the path shown matches what's set under SSL for the same domain. If you migrated the site, renamed the domain, or moved it to a new folder at any point, these can drift out of sync. Re-select the correct directory in the SSL settings and retry the renewal.

Step 4 — Only if the above didn't work: check for a Let's Encrypt rate limit

If aaPanel's error message mentions "too many certificates" or "too many failed authorizations," you've hit one of Let's Encrypt's rate limits (opens in a new tab). There's no way to bypass them: the failed-validation limit clears within an hour, while the limit of 5 identical certificates per 7 days refills one certificate every 34 hours. Wait, and fix Steps 1–3 first so the next attempt actually succeeds.

Verify the fix

  1. In aaPanel, confirm the SSL panel shows a new "valid until" date roughly 90 days out. Let's Encrypt is shortening certificate lifetimes (opens in a new tab) (64 days from February 2027, 45 days from February 2028), so expect this window to get shorter.
  2. Visit your site in an incognito/private browser window and confirm the padlock shows a valid certificate with no warnings.
  3. Check Cron again a few days later to confirm the renewal task is still present and hasn't been silently removed.

If you need to roll back

If the origin certificate has already expired and Cloudflare is set to Full (strict), visitors see an SSL error instead of the site. Switching Cloudflare to Full temporarily keeps the site reachable, because Full doesn't validate the origin certificate (opens in a new tab); switch back to Full (strict) as soon as the renewal succeeds. Only restore from the backup you took earlier if site files themselves were affected, which is rare for an SSL-only issue.

FAQ

Does turning off Cloudflare's proxy affect my site's speed or security during renewal?

Only briefly. While the domain is set to "DNS only," your visitors connect directly to your server instead of through Cloudflare's network, so you temporarily lose Cloudflare's caching and firewall for that domain. For the few minutes it takes to renew a certificate, this is a safe, standard trade-off — re-enable the proxy immediately after.

Can I avoid this happening again every 90 days?

Yes. Make sure the renewal task from Step 2 exists, and that the validation method works with your setup: if the site stays behind Cloudflare's proxy, switch to DNS validation so renewals don't depend on port 80 reaching your server. With both in place renewals run on their own, which matters more as Let's Encrypt moves to shorter certificate lifetimes.

Should I switch to Cloudflare's own SSL instead of aaPanel's Let's Encrypt certificate?

That's a valid alternative (Cloudflare can issue and manage its own edge certificate), but it changes your SSL/TLS mode setup and is a separate decision from fixing the current renewal failure — don't combine both changes in the same session, so you can tell which one fixed the problem.

Stefan Nistor

Founder, WP Fix Stack

Stefan runs WP Fix Stack. Every guide checks its commands, menu paths and limits against the official documentation of WordPress, PHP, the hosting panel, Cloudflare or the plugin involved, and links those sources so you can verify them. Fixes are ordered from the least risky step, each guide ends with a way to confirm the fix and roll it back, and guides are corrected, with a new Updated date, when the documentation or the software changes.

Every guide explains the symptom, likely causes, the safest order of checks and how to confirm the fix. How we check our guides.

On this page