I had this issue on a Debian 8 DigitalOcean droplet created using the 'user data' (web-form-posted setup script (bash or cloud-init)) option.
check systemd journal for relevant error messages:
journalctl | grep -B 1 -i "cron.*authentication token" | tail -n 3
May 19 13:17:01 debian-512mb-fra1-01 CRON[16714]: pam_unix(cron:account): expired password for user root (root enforced)
May 19 13:17:01 debian-512mb-fra1-01 CRON[16714]: Authentication token is no longer valid; new one required
May 19 13:17:01 debian-512mb-fra1-01 cron[470]: Authentication token is no longer valid; new one required
see which account(s) have expired status
cut -d: -f 1 /etc/passwd | while read U ; do chage -l $U | sed
"s|^|$U:|"; done | grep "must be"
root:Last password change : password must be changed
root:Password expires : password must be changed
root:Password inactive : password must be changed
use 'chage' tool to update expiry fields, first attempt
chage -I -1 -m 0 -M 999999 -W 31 root
Note: didn't have the desired effect until I also added the 'last-changed' option (-d)
use 'chage' tool to update expiry fields, second attempt
chage -d `date "+%F"` -E 2999-01-01 -I -1 -m 0 -M 999999 -W 31
root
check the field expiry
chage -l root
Last password change : May 19, 2017
Password expires : never
Password inactive : never
Account expires : Jan 01, 2999
Minimum number of days between password change : 0
Maximum number of days between password change : 999999
Number of days of warning before password expires : 31