Panellicense

Fix InterWorx license errors: invalid key and sync failures

Diagnose the Invalid InterWorx-CP License error — DNS and port 2443 checks, license.pex --sync, IP rebinding, and key swaps — before the 24-hour grace period ends.

4 min readUpdated 2026-07-16license · nodeworx · troubleshoot · activation
schema: HowToschema: FAQPage

When InterWorx loses contact with its licence server, NodeWorx and SiteWorx throw Invalid InterWorx-CP License and lock you out of the panel. Your sites and mail keep serving — the licensing check gates the control panel, not the services under it — and you get a 24-hour grace period before the panel suspends. That's your window to work through this list.

Nearly every case is one of four things: DNS, a blocked port, a stale IP binding, or a suspended key. Here's the fastest path through them.

Force a licence sync first

InterWorx validates against license.interworx.com on TCP 2443. Before diagnosing anything, just ask it to re-check:

~iworx/cron/license.pex --sync

If that returns cleanly, log back into NodeWorx — you're done, and the original failure was a transient network blip. If it errors, the message tells you which branch below you're in.

DNS: the server can't resolve the licence host

The most common failure, especially on fresh VPS images. Confirm resolution works at all:

ping -c2 license.interworx.com
ping -c2 google.com

If both fail, fix /etc/resolv.conf. Some providers (Vultr is the known offender) ship the file immutable, which also hangs goiworx.pex during first activation right after it writes iworx.ini:

chattr -i /etc/resolv.conf
chmod 644 /etc/resolv.conf

Add a working resolver, re-run the sync. If only the licence host fails, check for a local firewall or upstream filter eating the lookup.

Port 2443 blocked or a firewalled licence server

The XMLRPC handshake runs over 2443, and the classic symptom is:

XMLRPC error encountered Code: 2 Error: Invalid return payload:
enable debugging to examine incoming payload (XML error at line 1, check URL)

Open outbound 2443 in your firewall, and whitelist the licence server IP 207.32.181.150 if you run default-deny rules. Servers on NAT or a non-public IP fail here too — the licence is validated against the public address, so the panel host needs a routable IP.

IP changed without rebinding the licence

InterWorx keys are IP-locked. After a migration or a provider-side IP reassignment, the sync fails until the binding matches. For licences bought from us, sign in and rebind the IP on the licence row (or contact us and we'll reset it), then run license.pex --sync again.

Swapping to a different key entirely — say, moving from a trial to a paid InterWorx licence — takes one edit and a sync. The key lives in /home/interworx/iworx.ini under [iworx.license]:

vim /home/interworx/iworx.ini   # set key="YOUR_NEW_KEY"
~iworx/cron/license.pex --sync

If the sync reports the key has already been activated on a different IP, that's the binding again — reset it in the portal first.

Clock skew and file permissions

Two quieter causes worth checking if everything above passes:

date                                  # wrong clock breaks the TLS handshake
ls -la /home/interworx/.license      # must be iworx:iworx 0600

Fix the clock with chronyd/NTP and correct the permissions with chown iworx:iworx /home/interworx/.license && chmod 600 on the same path. A stale GPG lock in ~iworx/etc/gpg/ (look for pubring.kbx locks) can also block the sync — clear the lock file and retry.

If none of this lands, the key itself is expired or suspended — check billing before you check the server again. See checking licence status from the command line for the equivalent one-liners across every panel we sell.

Does an invalid InterWorx license take my websites down?+
No. Sites, mail, and DNS keep serving. The licence check locks NodeWorx and SiteWorx access only, and there's a 24-hour grace period before the panel suspends.
How do I force InterWorx to re-check its license?+
Run ~iworx/cron/license.pex --sync as root. It re-validates against license.interworx.com over TCP 2443 and prints the failure reason if it can't.
Where is the InterWorx license key stored?+
In /home/interworx/iworx.ini under the [iworx.license] section, with the licence file itself at /home/interworx/.license (permissions iworx:iworx 0600). Edit the key= value and run license.pex --sync to switch keys.
What ports does InterWorx licensing need?+
Outbound TCP 2443 to license.interworx.com, and the licence server IP 207.32.181.150 whitelisted if you run a default-deny firewall. The host must also resolve DNS and sit on a public IP.
Why does InterWorx say my key is already activated on a different IP?+
InterWorx keys are IP-locked. After a migration or IP change, the binding in the billing portal must be reset to the new address before license.pex --sync will succeed.

Next steps

Related articles

All troubleshooting →
troubleshoot
Rspamd on cPanel: what's actually supported in 2026
cPanel & WHM has no native Rspamd integration — here's what the built-in stack actually is, why community Rspamd-on-Exim setups are risky, and when switching panels is the real answer.
5 min read
troubleshoot
Fix JetBackup license errors: invalid, not found, and IP mismatch
Diagnose JetBackup's license validation errors — no license found for this IP, license invalid for current server, and reissue failures — and fix each from WHM or the CLI.
5 min read
troubleshoot
Check your hosting panel license status from the command line
Every panel and add-on has a one-line SSH command that tells you whether its license is valid, active, and locked to the right IP. Here's the exact command for each.
8 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.