How to fix cPanel license invalid and verification errors

The red "License invalid" banner in WHM almost never means your license is actually gone. In practice it's one of four things: the server's IP changed, outbound TCP 2089 is blocked, the clock has drifted past TLS tolerance, or the local license file is stale and needs a refresh. This article is a decision tree for working through them in order.

If you're seeing this on a server you provisioned today, jump straight to the IP check — that's the cause about 70% of the time.

Step 1: run cpkeyclt

cpkeyclt is the license refresh client. It re-fetches the license from verify.cpanel.net, writes it to /usr/local/cpanel/cpanel.lisc, and prints the reason on failure.

/usr/local/cpanel/cpkeyclt

A healthy result ends with Update succeeded. If you see that, hard-refresh WHM in your browser — the banner is cached for up to five minutes — and you're done.

Anything else, read the error verbatim. It almost always names the actual problem: No valid IP addresses means the licensed IP no longer matches; couldn't connect to host means a firewall or DNS issue; certificate verify failed means time drift.

Step 2: confirm the licensed IP matches the server

cPanel licenses are pinned to a public IPv4 address. If the server was restored from a snapshot, migrated between hypervisors, given a new floating IP, or moved behind a new NAT gateway, the license stops verifying.

Get the IP cPanel thinks it has:

curl -s https://myip.cpanel.net

Compare it to the IP on file with whoever issued the license. If they don't match, update the license to the new IP in your provider's control panel — for licenses bought through us, that's the license management portal where IP changes apply within a minute. Then re-run cpkeyclt.

Step 3: check outbound 2089 and DNS

cPanel verifies licenses over TCP 2089 to verify.cpanel.net. Some hosting networks and most corporate firewalls block this port by default.

curl -v https://verify.cpanel.net:2089/ 2>&1 | head -20
dig +short verify.cpanel.net

A successful TLS handshake and a resolved A record both need to work. If curl hangs or returns Connection refused, open 2089 outbound at the firewall layer — CSF, iptables, your cloud provider's security group, or whatever sits in front of the box. cPanel does not fall back to 443 for verification; 2089 is required.

If DNS fails entirely, fix /etc/resolv.conf first — there's no point fighting the license until name resolution works.

Step 4: fix the clock

TLS handshakes fail when the system clock drifts more than a few minutes from real time. This is common on freshly-restored VMs and bare-metal boxes whose RTC battery is dead.

timedatectl status
chronyc tracking

System clock synchronized: yes and a Last offset under a second are what you want. If not:

systemctl enable --now chronyd
chronyc -a makestep

Re-run cpkeyclt once the clock is in sync.

Step 5: nuclear option — wipe and refetch

If the four checks above all pass and the license still won't verify, the local license file may be corrupt. This happens after partial restores or interrupted updates.

rm -f /usr/local/cpanel/cpanel.lisc
/usr/local/cpanel/cpkeyclt

cpkeyclt will pull a fresh copy. If this still fails with No valid IP addresses and the IP definitely matches, the license itself is either expired or has been transferred away from your server. At that point, check your reseller portal — for our customers, expired licenses show up on the license management page and can be renewed in-place.

When to actually buy a new licence

If the license was issued by a different provider and you can't reach them, or the licensee left the company and you've lost portal access, the fastest path is a fresh licence on the server's current IP. We issue new cPanel licenses within five minutes of payment and they activate against cpkeyclt immediately — no manual steps on your end past re-running the command.

Why does cPanel say my license is invalid after I changed the IP?+

cPanel licenses are pinned to a specific public IPv4. Changing the IP — including via snapshot restore, floating IP reassignment, or migration — invalidates the license until you update it on the issuer's side and run cpkeyclt again.

What port does cPanel use to verify licenses?+

TCP 2089 outbound to verify.cpanel.net. It does not fall back to 443. If your firewall or hosting network blocks 2089, license verification will always fail regardless of what's on the server.

How often does cPanel re-check the license?+

Automatically every 24 hours, plus on every WHM login and any time you run cpkeyclt manually. The cached verdict in WHM can lag by up to five minutes after a successful refresh — a browser hard-refresh usually clears it.

Does the License invalid banner stop cPanel from working?+

Not immediately. cPanel runs in a 3-day grace period after the last successful verification. After that, account creation, package edits, and most WHM functions are blocked until the license verifies again. Existing sites keep serving.

Can I move a cPanel license between two servers?+

Yes. IP transfers are free and instant on most reseller portals — change the IP on file, then run cpkeyclt on the new server. There's no need to deactivate the old server first; the license simply follows the IP it's pinned to.

Next steps

How to install cPanel on a fresh VPS — start from a clean build if the existing one is too tangled to recover.
Migrating cPanel accounts to a new server — sibling workflow when you're moving boxes anyway.
Understanding cPanel license proration — how billing handles IP changes and mid-month transfers.