My domain is blocked from certificate issuance and I'd like to understand why, since I have a legitimate use case (mail server TLS certificate) and no policy violation that I'm aware of.
Domain: mail.metrotek.ru
Error (production, api/new-order):
json
{
"type": "urn:ietf:params:acme:error:rejectedIdentifier",
"detail": "Error creating new order :: Cannot issue for \"mail.metrotek.ru\": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy",
"status": 400
}
Same error reproduced on staging (acme-staging-v02.api.letsencrypt.org), same domain, same day — so this doesn't look like a production-only or rate-limit issue, and not an account-specific issue since I tried with a fresh account on staging as well.
What's not the cause (already ruled out):
- No CAA record restricting issuance (
metrotek.ruandmail.metrotek.ruhave no CAA records at all). - DNS-01 validation itself works fine — the
_acme-challenge.mail.metrotek.ruTXT record is created, propagates, and validates successfully before the order creation step fails (the failure happens atnew-order, before any authorization/challenge is attempted). - Other subdomains of the same zone continue to issue normally and recently (e.g.
www.metrotek.ru,ntc.metrotek.ru,stc.metrotek.ru— all issued successfully as recently as August 2026, per crt.sh). - This specific hostname (
mail.metrotek.ru) issued successfully many times before, most recently 2026-07-15 (crt.sh shows a clean issuance history going back over a year, with regular ~90 day renewals).
History: the certificate for mail.metrotek.ru was renewed successfully on 2026-07-15 (serial 055d0226c3f1cf7b6a35226211a71693b933, valid until 2026-10-13). All subsequent renewal attempts (automated, via win-acme with DNS-01 validation) have failed with the above error since approximately 2026-09-08.
Given that only this exact hostname is affected, while sibling hostnames in the same DNS zone continue to issue without issue, this looks like either:
- the hostname itself landed on some internal policy list (safe browsing / abuse list) between mid-July and September, or
- some other automated policy check specific to this exact name.
Could someone from the Let's Encrypt team take a look and let me know what policy is blocking this specific hostname, and whether there's a way to get it reviewed/removed? Happy to provide any additional details needed to verify domain control.
Thank you!