cPanel License Update Failed: Fix cpkeyclt Errors, Port 2089, DNS, IP and Clock Problems

Updated: 8 October 2026 · Applies to: cPanel & WHM 138 on AlmaLinux 9 and Ubuntu 24.04 (root access), firewalld 1.3, CSF

This guide is for a cPanel licence update that fails. For the normal update command, checks and renewals, see cPanel licence update command. Here you match the error from /usr/local/cpanel/cpkeyclt to its cause, fix it and run the command again.

Read the exact error

According to cPanel, a failed run prints Updating cPanel license...Done. Update Failed!, then Error message: and a line starting The exact message was: with the reason and your IP. The licence log (root only) keeps every attempt:

grep -E 'succeeded|failed after|exact message|Timed out' /usr/local/cpanel/logs/license_log | tail -n 10

What each message means

• The license is expired. No active licence: renew it first (cPanel licence is expired). Real lines from our server before renewal:

  The cPanel license server said that a license could not be issued for your server (66).
  For more information visit: https://www.cpanel.net/lic/
  The exact message was: The license is expired. (198.51.100.10)
  License update failed after trying 1 server

• No valid cPanel/WHM license found. (IP) or No Paid License for this server: no licence exists for that IP. See the IP section below.
• Your clock is too far off NIST time. The server time is wrong.
• Timed out while connecting to port 2089 (in the log): outgoing 2089 is blocked. According to cPanel, the client then tries ports 23, 25, 80, 110, 143, 993 and 995.
• DNS query failure (auth.cpanel.net/A): the server cannot resolve the licence servers.
• Can't confirm this connection was from a root owned process. According to cPanel, the licence file could not be delivered because incoming TCP 2083 is blocked.
• A License check appears to already be running. Retry in a minute. If it persists, cPanel says /run may be out of inodes (df -i /run at 100%); reboot.
• Transition to SSL failed on 2089 ... certificate verify failed: the CA bundle is damaged. cPanel's fix is dnf reinstall ca-certificates (Ubuntu: apt install --reinstall ca-certificates), then cpkeyclt.
• Skipping license update since it was updated N minutes ago. Not a failure: a check ran moments ago. Read the lines above it.

Port 2089 and firewall rules

The licence client connects out to TCP 2089. According to cPanel the server also needs outgoing port 53 (TCP and UDP) for DNS and incoming TCP 2083 for the licence file (2087 on DNSOnly servers). Test the outgoing port without extra packages:

timeout 5 bash -c '</dev/tcp/auth.cpanel.net/2089' && echo open

Or with Ncat (nmap-ncat). Real output on AlmaLinux 9.8, port open, then outgoing 2089 dropped (addresses replaced):

# nc -vz -w 5 auth.cpanel.net 2089
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected to 203.0.113.3:2089.

# nc -vz -w 5 auth.cpanel.net 2089
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connection to 203.0.113.82 failed: TIMEOUT.
Ncat: Trying next address...

Skip curl telnet:// here: AlmaLinux 9's curl-minimal replies Protocol "telnet" not supported or disabled in libcurl.

CSF

CSF sets allowed outgoing ports in TCP_OUT in /etc/csf/csf.conf. Check yours with grep -E '^(TCP_IN|TCP_OUT|UDP_OUT) ' /etc/csf/csf.conf. The default csf.conf in cPanel's cpanel-csf source already includes 2089:

TCP_OUT = "20,21,22,25,37,43,53,80,110,113,443,587,853,873,993,995,2086,2087,2089,2703"

If 2089 is missing, add it to TCP_OUT and TCP6_OUT, keep 2083 in TCP_IN and 53 in UDP_OUT, then restart CSF and LFD with csf -ra.

firewalld

firewall-cmd --permanent --add-port=2089/tcp does not fix this: zones filter incoming traffic, so it only opens 2089 inbound. firewalld filters outgoing traffic only if someone added a policy with ingress zone HOST, or a direct rule. In our test (firewalld 1.3.4), a REJECT output policy blocked the port (Ncat: No route to host.), opening it in the zone changed nothing, and adding it to the policy fixed it:

firewall-cmd --list-all-policies
firewall-cmd --direct --get-all-rules
firewall-cmd --permanent --policy POLICY_NAME --add-port=2089/tcp
firewall-cmd --reload

Also check any provider or cloud firewall in front of the server.

DNS resolution

host auth.cpanel.net

It should list several addresses (six in our test). If not, fix the resolvers in /etc/resolv.conf (how to change DNS settings) and check outgoing port 53. With a broken resolver, our test container got Could not resolve host: myip.cpanel.net.

IP mismatch, NAT and multiple IPs

The licence must be for the IP the server uses to reach cPanel:

curl -w '\n' -s https://myip.cpanel.net/v1.0/

• Several IPs: according to cPanel, outgoing connections use the main IP of the interface that carries the default route. Compare ip -4 route show | grep default with ip -4 addr show | grep inet, then make the licensed IP the main IP there (keep console access in case the network drops) or ask your provider to move the licence.
• NAT: cPanel supports 1:1 NAT only, and the licence must be for the public IP. The /var/cpanel/cpnat file maps local to public addresses; rebuild it with /usr/local/cpanel/scripts/build_cpnat.

Time sync

Run timedatectl and look for System clock synchronized: yes. If it says no, run timedatectl set-ntp true (time sync with NTP), or cPanel's /usr/local/cpanel/scripts/rdate, then cpkeyclt again.

Still failing?

Check the IP on cPanel's licence verification page. If no active licence is listed, your provider has to fix it. Bought from Ucartz? Open a ticket with the server IP and the exact message.

Official documentation: How to Configure Your Firewall for cPanel & WHM Services, firewalld policies.