Clean instalation and prevents issuance status:403


I spent som time trying to get certificate (difrent apache virtualhosts configurations ) but without success.
finnaly i made clean instalation ubuntu 18 , just install Apache2 (all defaults and standard start page /var/www/html/index.html) and then started certboot procedure to gain certificate, but still without success
. What is wrong ?
My domain is:

I ran this command:
root@got-wyn:~# sudo certbot --apache

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter ‘c’ to

Please read the Terms of Service at You must
agree in order to register with the ACME server at

(A)gree/©ancel: a

Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let’s Encrypt project and the non-profit
organization that develops Certbot? We’d like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.

(Y)es/(N)o: y
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated) (Enter ‘c’ to cancel):
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for
Enabled Apache rewrite module
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. (http-01): urn:ietf:params:acme :error:caa :: CAA record for prevents issuance


  • The following errors were reported by the server:

    Type: None
    Detail: CAA record for prevents issuance

  • Your account credentials have been saved in your Certbot
    configuration directory at /etc/letsencrypt. You should make a
    secure backup of this folder now. This configuration directory will
    also contain certificates and private keys obtained by Certbot so
    making regular backups of this folder is ideal.

My web server is (Apache/2.4.29 (Ubuntu)):

The operating system my web server runs on is (ubuntu 18:

My hosting provider, if applicable, is:
it is VPS on

I can login to a root shell on my machine (yes ):

I’m using a control panel to manage my site (no):

The version of my client is (certbot 0.28.0):

I paste part of Log (new users can’t upload attachements and are limited text length):

HTTP 200
Server: nginx
Content-Type: application/json
Content-Length: 1433
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Fri, 22 Feb 2019 16:45:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 22 Feb 2019 16:45:55 GMT
Connection: keep-alive

“identifier”: {
“type”: “dns”,
“value”: “”
“status”: “invalid”,
“expires”: “2019-03-01T16:45:48Z”,
“challenges”: [
“type”: “tls-alpn-01”,
“status”: “invalid”,
“url”: “”,
“token”: “_7LE2-64H2Y8K0cMNyE-cYtYu28KO2NwPWzhjbZHEQk”
“type”: “http-01”,
“status”: “invalid”,
“error”: {
“type”: “urn:ietf:params:acme:error:caa”,
“detail”: “CAA record for prevents issuance”,
“status”: 403
“url”: “”,
“token”: “ze1agA-6d0CzN2rpWHf4vBZKXPww1aAwQhSs1euHF1o”,
“validationRecord”: [
“url”: “”,
“hostname”: “”,
“port”: “80”,
“addressesResolved”: [
“addressUsed”: “”
“type”: “dns-01”,
“status”: “invalid”,
“url”: “”,
“token”: “2gTiOc81UCmYyYAiOdUbGCyO4xGUF01vhuOOTWzrT8U”
2019-02-22 17:45:55,584:DEBUG:certbot.reporter:Reporting to user: The following errors were reported by the server:

Type: None
Detail: CAA record for prevents issuance
2019-02-22 17:45:55,585:DEBUG:certbot.error_handler:Encountered exception:
Traceback (most recent call last):
File “/usr/lib/python3/dist-packages/certbot/”, line 82, in handle_authorizations
self._respond(aauthzrs, resp, best_effort)
File “/usr/lib/python3/dist-packages/certbot/”, line 161, in _respond
self._poll_challenges(aauthzrs, chall_update, best_effort)
File “/usr/lib/python3/dist-packages/certbot/”, line 232, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
certbot.errors.FailedChallenges: Failed authorization procedure. (http-01): urn:ietf:params:acme:error:caa :: CAA record for prevents issuance


Hi @remian,

There is a CAA DNS record for served by that only allows to issue certificates for By default, this also applies to subdomains.

You can either get the administrator of the DNS to add an additional CAA record that allows to issue certificates, or add a CAA record that allows this for your specific subdomain.


dig CAA @
dig CAA @
[there is no nslookup command to return CAA records]

which returns: 120 IN CAA 0 issue ""


Newer versions of nslookup do also understand this RR type.


You are correct; I should have been more clear.
There is no nslookup command (in WINDOWS) to return CAA records (yet).
Of course, there is also no DIG command found in WINDOWS [right out-of-the-box].
So, I logically assigned them respectively to their default O/S.

But, yes (you are correct), new versions of Linux can do both.
dig CAA @
nslookup -q=CAA


Thank You for fast answers!

I wrote to and they quickly add new rows to DNS configuration. New configuration allready propagated and now certbot menage to get cert for me. So now its all ok. Once more thank’s for help!


Hi @remian

yep, now your subdomain - specific CAA is visible:

CAA - Entries

Domainname flag Name Value ∑ Queries ∑ Timeout 5 issue 1 0
9 issuewild 1 0 5 issue 1 0
pl 0 no CAA entry found 1 0

issue includes issuewild, so the issuewild isn’t required. But now you can create normal certificates and wildcard-certificates via Letsencrypt.

PS: But your configuration is incomplete. You have a dns-entry, but your certificate has only one domain name:
expires in 90 days - 1 entry

So your www - version isn’t secure.

  • Remove the dns entry of www… or (better)
  • create one certificate with both domain names and use that instead.

Some users add every time www, some users never add www, so it’s the best to have one vHost with both domain names, that uses one certificate with both domain names.

closed #8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.