DNS identifier has too many labels

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domains are: locations.client.com.qa.example.com, assets.locations.client.com.qa.example.com, maps.locations.client.com.qa.example.com, rstatic.locations.client.com.qa.example.com

I ran this command:
acme.sh --issue --apache -d locations.client.com.qa.example.com -d assets.locations.client.com.qa.example.com -d rstatic.locations.client.com.qa.example.com -d maps.locations.client.com.qa.example.com

It produced this output:
Create new order error. Le_OrderFinalize not found. {"type":"urn:ietf:params:acme:error:rejectedIdentifier","status":400,"detail":"DNS identifier has too many labels [assets.locations.client.com.qa.example.com]"}

2

Hello @gassmann88, welcome to the Let's Encrypt community. :slightly_smiling_face:

You may find acme.sh support here GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol
And the wiki Home · acmesh-official/acme.sh Wiki · GitHub

1 Like
3

Boulders maxlabel limit is 10(hardcoded in pa.go), so if you used exactly that format(it has 7 lables) on Let's encrypt it would been succeeded

1 Like
4

I'm using zero ssl and it has been working up until Friday morning. When using letsencrypt, I seem to be running into an issue with the CA certificate bundle on the server since I'm getting the following error when running:

--server letsencrypt

Please refer to libcurl - Error Codes for error code: 60
== Info: SSL certificate problem: unable to get local issuer certificate
== Info: Closing connection 0

5

what is your server OS?

3 Likes
6

I think this means your local list of CA root certificates is outdated and doesn't include ISRG Root X1.

5 Likes
7

Yup. I saw it today over in the Cloudflare Community, too. Here is the link I offered there.

5 Likes
8

I am using Zero SSL.

9

You might want to check the ZeroSSL forums and their own support.

1 Like
10

OrangePizza asked what operating system you were using when trying Let's Encrypt.

It likely doesn't have the needed root cert to talk with LE.

If you want to keep using Zero SSL, yeah, this isn't the best forum to ask about that.

5 Likes
11

ZeroSSL recently implemented a change to stop spammers, and one of those is to limit their free endpoint to a certain number of domain labels. It was accounting for a significant portion of abuse on their free endpoint.

6 Likes