Confirm which certificate failed and how urgent it is
Check the live certificate and the exact failed name before retrying DirectAdmin renewal or altering DNS.
A panel renewal error and a browser warning can refer to different certificates or hostnames. For each affected live hostname, record the certificate’s expiry date, covered names and browser error. Compare example.com with www.example.com; a valid certificate on one does not prove the other works. A DirectAdmin login or mail-service hostname may use a separate server certificate from your website domain. If the live certificate has expired, treat this as a service incident and contact Novasean support through your agreed route while continuing read-only checks.
Do not disable HTTPS, remove HSTS, delete the existing certificate or repeatedly request a new certificate merely to suppress a browser warning. Keep the current certificate and configuration available for diagnosis. A pending renewal can fail for one selected name even when the primary website hostname works.
Check the domain and ACME settings in your authorised panel
- In DirectAdmin, select the intended domain and open the SSL Certificates area if your account offers it. Confirm that an automatic ACME certificate is actually configured for this domain and inspect its selected names and current status. The exact labels and provider options depend on the installed version and service.
- Note the time of the last renewal attempt and copy the relevant error text or task reference. If the panel lacks the details, ask Novasean to check the administrator-side ACME request log; do not request root access or edit server files yourself.
- Check whether the selected names include an obsolete subdomain, domain pointer or
wwwhostname that no longer points to this service. Ask the domain owner before changing coverage: removing a name that customers still use could leave that name without valid HTTPS.
DirectAdmin supports automatic domain-certificate issue and renewal when ACME is enabled. Its documentation also describes administrator logs for recent requests. A missing or old log may mean no renewal request was triggered; it is not proof that DNS validation succeeded.
Match the error to the validation route
HTTP challenge cannot be reached
For a non-wildcard HTTP challenge, check that each requested hostname resolves to the intended web service and that its HTTP validation path can be reached from outside. Compare authoritative A and AAAA records; an obsolete IPv6 destination can make one path fail. Unsupported or excessive redirects, access restrictions or a proxy may also interfere. Ask the operator to inspect the exact challenge URL and web-server mapping. Do not turn off a site-wide security control without a scoped diagnosis and rollback.
DNS challenge or wildcard fails
A wildcard requires DNS validation. Confirm which provider hosts the authoritative zone, whether the expected TXT record can be published there and whether the authorised DNS integration still works. Do not paste DNS API credentials into a ticket or create a broad token simply to retry. The DNS owner and operator should inspect the record and the least-privilege integration together.
CAA or DNS error
If the error names CAA or SERVFAIL, inspect the exact requested hostname and any applicable parent CAA policy, plus nameserver and DNSSEC health. An unrelated selected alias can block an entire request. Preserve legitimate issuer restrictions; authorise a certificate authority only after confirming it is the one the service intends to use.
Fix the identified cause before one controlled retry
Make only the change supported by the evidence: correct a stale address, restore a reachable challenge path, repair the authorised DNS integration, or remove a genuinely obsolete name from the certificate request. Record the previous value and allow DNS caches to expire where relevant. Coordinate the retry with Novasean if the customer panel does not expose a safe action or the certificate is already expired. Repeated attempts without fixing validation can consume provider limits and hide the useful first error.
After a successful renewal, test the actual HTTPS endpoint from outside the hosting account. Confirm its new validity dates, every required Subject Alternative Name, the expected issuer and the served certificate, then test a representative page. A panel message saying “issued” does not by itself prove the web server is serving the new certificate.
For example, if an obsolete www record points away, correct it only after confirming www belongs on this certificate. Check the authoritative answer and served certificate before declaring renewal recovered.
Send support evidence that identifies the failing step
Give Novasean the service and domain names, the exact failing hostname, certificate expiry time and time zone, selected names, the panel error or task reference, and the results of external A, AAAA and CAA checks. Say whether the public site is currently showing a browser warning. Ask the operator to confirm whether the failure is request scheduling, ACME validation, certificate installation or a separate server-hostname certificate. Do not send private keys, account passwords, DNS API tokens or full unredacted logs.
Can I use a certificate from another hostname temporarily? Only if that certificate covers the exact name and is installed through an authorised service process. Does a browser warning prove renewal failed? No. A renewed certificate may exist in the panel while a proxy or web server still presents an older one. Will changing DNS fix every renewal error? No. Identify the challenge and failing name first.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.