# Authorizations for these names not found or expired

**URL:** <https://community.letsencrypt.org/t/authorizations-for-these-names-not-found-or-expired/3028>\
**Category:** Help\
**Created:** [November 5, 2015, 7:07am UTC](https://community.letsencrypt.org/t/authorizations-for-these-names-not-found-or-expired/3028 "2015-11-05T07:07:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![xotc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/xotc/32/1638_2.png) [@xotc](https://community.letsencrypt.org/u/xotc)\
**Post date:** [November 5, 2015, 7:07am UTC](https://community.letsencrypt.org/t/authorizations-for-these-names-not-found-or-expired/3028/1 "2015-11-05T07:07:59Z")

</div>

I’ve been trying to get a certificate using a certificate signing request I’ve generated myself because I’ve been using public key pinning and want to keep the same key pair.

I ran into [this](https://community.letsencrypt.org/t/asn1-error-when-using-csr/2188) issue where the csr had to be in der format and I’ve fixed that but now when I run the client

```
./letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory auth --csr /home/michael/ssl/csr.der

```

I get an error message

```
Error: unauthorized :: The client lacks sufficient authorization :: Error creating new cert :: Authorizations for these names not found or expired: xo.tc

```

I’ve picked the ‘Automatically use a temporary webserver’ option and I can see it comes up with 200 when the well-known page is requested. I’ve seen other issues that look similar that are 'Name is not whitelisted’  
but this is ‘Authorizations for these names not found or expired’ and I’ve checked the two domains names ([xo.tc](http://xo.tc) and [www.xo.tc](http://www.xo.tc)) are in the Closed Beta Invite email.

It fails when I run it with Apache as well. I can post the logs from `/var/log/letsencrypt` if they will be of use.

---

<div class="post-metadata">

**Author:** ![xotc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/xotc/32/1638_2.png) [@xotc](https://community.letsencrypt.org/u/xotc)\
**Post date:** [November 5, 2015, 2:05pm UTC](https://community.letsencrypt.org/t/authorizations-for-these-names-not-found-or-expired/3028/2 "2015-11-05T14:05:55Z")

</div>

I’ve figured out the issue (or at least what it was in my case).

In the csr I had the Subject as the root domain `CN=xo.tc` and in the Subject Alternative Name I just had the subdomain `DNS:www.xo.tc` but you need both names in the Subject Alternative Name section so in my case `DNS:www.xo.tc, DNS:xo.tc`

I’m not sure if this is a bug (and I should open an issue on GitHub?) or if I’ve being doing my Certificate Signing Requests wrong all along and previous CAs have just been forgiving of poorly formatted CSRs.

EDIT to add: Also, it works on the test server with the CSR that only has one name in the SAN section (and gets a cert that’s valid for both) but doesn’t work on production.