Can't issue certificate due to "Policy"

[ameer]

Hello,
We have been issuing wildcard cert for domain *.syriatel.sy for a while with let’s encrypt. recently certificate got revoked and renewal fails with “due to Policy” error.
What can be done please, and why the reason for sudden rejection.
Thank you

[tdelmas]

Maybe because SYRIATEL is on the SDN list: https://www.treasury.gov/ofac/downloads/sdnlist.txt

See also Certificates issued to persons or entities on the U.S. Treasury Department’s Specially Designated Nationals list

And According to mcclatchydc.com Let's Encrypt revoqued and banned USAReally.com - #10 by josh :

@josh

As a U.S.-based organization we are required to comply with U.S. law. As such, we cannot provides services to people, organizations, or websites listed on the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) Specially Designated Nationals (SDN) list.

[tdelmas]

My advice to avoid that situation in the future: avoid US-based CA, even if they accept to issue a certificate, they may revoke it without warning.

For example, there is Buypass (https://en.wikipedia.org/wiki/Buypass), a Norwegian CA compatible with the ACME protocol for free certificates https://www.buypass.com/ssl/resources/acme-free-ssl (but limited to one domain per certificate, and without wildcard).

(I don’t know if Norway/Europe have such restriction against SYRIATEL)

But maybe you think the interpretation of the SDN list by Let’s Encrypt was too narrow and they should accept to issue certificates to SYRIATEL?