# Attempting to generate cert, getting "UnicodeError: encoding with 'idna' codec failed"

**URL:** <https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675>\
**Category:** Help\
**Created:** [May 11, 2018, 4:55pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675 "2018-05-11T16:55:14Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 11, 2018, 4:55pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/1 "2018-05-11T16:55:14Z")

</div>

My domain is: [api.nais.org](http://api.nais.org)

I ran this command:

`certbot certonly --agree-tos --email myemail@gmail.com --webroot -w /var/lib/letsencrypt/ -d api.nais.org`

It produced this output:

```
2018-05-11 16:52:10,369:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "POST /acme/reg/34795080 HTTP/1.1" 202 658
2018-05-11 16:52:10,370:DEBUG:acme.client:Received response:
HTTP 202
Server: nginx
Content-Type: application/json
Content-Length: 658
Boulder-Requester: 34795080
Link: <https://acme-v01.api.letsencrypt.org/acme/new-authz>;rel="next", <https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf>;rel="terms-of-service"
Replay-Nonce: ElgNu8wfpAQ5IX1CITyFR5mlgIsavV1k-urmT6-RC2k
Expires: Fri, 11 May 2018 16:52:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 11 May 2018 16:52:10 GMT
Connection: keep-alive

b'{\n "id": 34795080,\n "key": {\n "kty": "RSA",\n "n": "tIG4lSXihMmyhOND2ZkfoOzSICmx7PamI_jfUEGT3GeZBcnAZTLeILL0I26xWBqJuQk4lH9ti3f8EeRW51jegKSidyVQdfKP-GE4bIdc2PLkt8gRDL2W988nJ1hFqKegnphREiZYLc6nGjn8ygcmleddkI4amih1aaGdLUhaIw6FTSPWc6ZkVCoSE-RxO9V44XhXPqnTCfhLvXCejyX_RVEClMjhDWsNSbmjG0uyJSo2GvPGOI96uG0z98XV7SgxKmWoFwUF1r2a6y-VClFaHrQvJpIALWKByD1lI2Fu42oVXx1oInI6cHjDM-rMM933LkOpozwzphda6imOWpJEIQ",\n "e": "AQAB"\n },\n "contact": [\n "mailto:myemail@gmail.com"\n],\n "agreement": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",\n "initialIp": "165.227.28.242",\n "createdAt": "2018-05-11T16:52:10Z",\n "status": "valid"\n}'
2018-05-11 16:52:10,370:DEBUG:acme.client:Storing nonce: ElgNu8wfpAQ5IX1CITyFR5mlgIsavV1k-urmT6-RC2k
2018-05-11 16:52:10,371:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/lib/python3.6/encodings/idna.py", line 167, in encode
    raise UnicodeError("label too long")
UnicodeError: label too long

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/usr/bin/certbot", line 11, in <module>
    load_entry_point('certbot==0.23.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 1266, in main
    return config.func(config, plugins)
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 1141, in certonly
    le_client = _init_le_client(config, auth, installer)
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 635, in _init_le_client
    acc, acme = _determine_account(config)
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 514, in _determine_account
    config, account_storage, tos_cb=_tos_cb)
  File "/usr/lib/python3/dist-packages/certbot/client.py", line 168, in register
    acc = account.Account(regr, key)
  File "/usr/lib/python3/dist-packages/certbot/account.py", line 57, in __init__
    creation_host=socket.getfqdn()) if meta is None else meta
  File "/usr/lib/python3.6/socket.py", line 673, in getfqdn
    hostname, aliases, ipaddrs = gethostbyaddr(name)
UnicodeError: encoding with 'idna' codec failed (UnicodeError: label too long)
2018-05-11 16:52:10,372:ERROR:certbot.log:An unexpected error occurred:

```

My web server is (include version):  
nginx version: nginx/1.14.0 (Ubuntu)

The operating system my web server runs on is (include version):  
Ubuntu 18

My hosting provider, if applicable, is:  
Digital ocean

I can login to a root shell on my machine (yes or no, or I don’t know):  
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):  
no

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 11, 2018, 5:13pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/2 "2018-05-11T17:13:41Z")

</div>

Hi @stephaniewilkinson,

This is an unusual error which I don’t think we’ve come across before. Could you please help me understand more about why this is happening?

Probably seeing the output from running this command would help:

`python3 -c 'import socket; print(socket.getfqdn())'`

If that shows an error too, maybe you could run

`python2 -c 'import socket; print(socket.getfqdn())'`

and if that shows an error too, maybe you could run

`hostname`

---

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 11, 2018, 5:19pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/3 "2018-05-11T17:19:46Z")

</div>

Thanks for helping!

When I run:  
`$ python3 -c 'import socket; print(socket.getfqdn())'`

The output is:

```
Traceback (most recent call last):
  File "/usr/lib/python3.6/encodings/idna.py", line 167, in encode
    raise UnicodeError("label too long")
UnicodeError: label too long
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python3.6/socket.py", line 673, in getfqdn
    hostname, aliases, ipaddrs = gethostbyaddr(name)
UnicodeError: encoding with 'idna' codec failed (UnicodeError: label too long)

```

When I run:  
`python2 -c 'import socket; print(socket.getfqdn())'`

The output is:  
`ruby-rails-s-1vcpu-1gb-sfo2-01-1525916611287-s-2vcpu-4gb-sfo2-01.localdomain`

When I run:  
`hostname`

The output is:  
`ruby-rails-s-1vcpu-1gb-sfo2-01-1525916611287-s-2vcpu-4gb-sfo2-01`

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 11, 2018, 5:26pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/4 "2018-05-11T17:26:17Z")

</div>

Thanks!

So, there are some Internet standards that say that the longest allowable label in a DNS name is 63 bytes. Your hostname `ruby-rails-s-1vcpu-1gb-sfo2-01-1525916611287-s-2vcpu-4gb-sfo2-01` is 64 bytes.

> **[Domain Name System | Domain name syntax](https://en.wikipedia.org/wiki/Domain_Name_System#Domain_name_syntax)**
>
> The definitive descriptions of the rules for forming domain names appear in RFC 1035, RFC 1123, and RFC 2181.
> A domain name consists of one or more parts, technically called labels, that are conventionally concatenated, and delimited by dots, such as example.com.
> The right-most label conveys the top-level domain; for example, the domain name www.example.com belongs to the top-level domain com.
> The hierarchy of domains descends from right to left; each label to the left specifies a subdivision, ...

This wouldn’t directly bother Certbot (and wouldn’t bother Let’s Encrypt if you’re not literally trying to get a certificate covering that name), but it looks like some of Python 3’s internal logic crashes when asked to deal with hostnames that are longer than 63 bytes.

We’ll probably need to discuss whether we want to ask the Python developers to change this or whether we want to change the particular function that we call here. In the meantime, you could work around this by

- changing your system’s hostname so that it’s less than 64 bytes long
- running Certbot with Python 2 rather than Python 3 (maybe edit `/usr/bin/certbot` so that it starts with `#!/usr/bin/python2` instead of `#!/usr/bin/python3`?)
- editing the Certbot code on your system so that it uses some other value for your local host name here
- using a different Let’s Encrypt client rather than Certbot

Those are all the options that I can think of for the moment. 🙂

---

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 11, 2018, 5:34pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/5 "2018-05-11T17:34:22Z")

</div>

Thanks for those ideas!

Let’s encrypt is now rate limiting me because of too many attempts 😑

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 11, 2018, 5:37pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/6 "2018-05-11T17:37:53Z")

</div>

Which rate limit message do you see?

---

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 11, 2018, 5:39pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/7 "2018-05-11T17:39:56Z")

</div>

```
An unexpected error occurred:
There were too many requests of a given type :: Error creating new registration :: too many registrations for this IP: see https://letsencrypt.org/docs/rate-limits/

```

I still have yet to install a cert though:

[https://crt.sh/?q=api.nais.org](https://crt.sh/?q=api.nais.org)

![image](https://global.discourse-cdn.com/letsencrypt/original/3X/5/5/5537028fafdd83df6765fdcf79d4224d78adc5f6.png)

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 11, 2018, 5:44pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/8 "2018-05-11T17:44:11Z")

</div>

I’m sorry that this bug has triggered that limit. The limit in question will reset in three hours (probably starting from the time of your first unsuccessful attempt).

---

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 11, 2018, 5:52pm UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/9 "2018-05-11T17:52:10Z")

</div>

Good to know! The docs said a week, so i was a little worried. Thanks for your help! I’m going to try renaming my domain first. (I tried rolling back python but it required an old version (‘certbot==0.23.0’) that I didn’t have.

---

<div class="post-metadata">

**Author:** ![stephaniewilkinson](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stephaniewilkinson/32/23186_2.png) [@stephaniewilkinson](https://community.letsencrypt.org/u/stephaniewilkinson)\
**Post date:** [May 12, 2018, 1:03am UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/10 "2018-05-12T01:03:45Z")

</div>

For anyone else who is having this problem, here are steps to fix it:

`$ hostname`

will give you your hostname

`$ hostname new-hostname`

will reset your hostname so you can make it shorter, and try certbot again.

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 12, 2018, 1:17am UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/11 "2018-05-12T01:17:59Z")

</div>

> [@stephaniewilkinson](#):
>
> $ hostname new-hostname
> 
> will reset your hostname so you can make it shorter, and try certbot again.

Note that changes made by `hostname` aren't saved permanently. It will be reset next time you reboot.

The hostname is stored in `/etc/hostname`, but it can be managed dynamically and overwritten by any number of things, like the DHCP client or cloud-init.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 12, 2018, 6:36am UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/12 "2018-05-12T06:36:07Z")

</div>

I’ve also created an issue at

> <https://github.com/certbot/certbot/issues/5958>

to track Certbot’s response to this issue, although I’m not sure how high a priority it will be.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 11, 2018, 6:36am UTC](https://community.letsencrypt.org/t/attempting-to-generate-cert-getting-unicodeerror-encoding-with-idna-codec-failed/61675/13 "2018-06-11T06:36:10Z")

</div>

Closed on June 11, 2018, 6:36am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.