How to Fix CyberPanel Let's Encrypt SSL Issuance and Renewal Errors

Seeing the dreaded **"Your connection is not private (NET::ERR_CERT_COMMON_NAME_INVALID)"** warning on a CyberPanel website? Let's Encrypt automated verification can fail for a handful of specific reasons.

Here is how to diagnose and issue a fresh SSL certificate in CyberPanel.

Reason 1: DNS Not Fully Propagated or Missing WWW Record Let's Encrypt verifies domain ownership by making an HTTP request to `http://yourdomain.co.ke/.well-known/acme-challenge/`. - Both `yourdomain.co.ke` AND `www.yourdomain.co.ke` MUST resolve to your CyberPanel IP address. If the `www` record is missing or points elsewhere, SSL issuance fails for the entire domain! - Verify DNS propagation with `whatsmydns.net` before clicking Issue SSL.

Reason 2: Port 80 Blocked by Firewall Let's Encrypt ACME challenge requires **Port 80 (HTTP)** to be open to the internet. If you blocked port 80 via UFW/firewalld thinking "I only need HTTPS", renewal will fail every time. Run via SSH: ```bash sudo ufw allow 80/tcp sudo ufw allow 443/tcp ```

Reason 3: Outdated or Broken .well-known Directory Permissions Sometimes the challenge directory has broken permissions: 1. In CyberPanel File Manager, open `/home/yourdomain.co.ke/public_html/` 2. Ensure permissions on `.well-known` are set to `755` and owned by your website user.

Reason 4: Issue via SSH CLI If the CyberPanel UI times out, run the ACME script directly via terminal: ```bash /root/.acme.sh/acme.sh --issue -d yourdomain.co.ke -d www.yourdomain.co.ke -w /home/yourdomain.co.ke/public_html --force ``` Once issued, CyberPanel automatically links the certificate to OpenLiteSpeed!