Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: www.domain.top
I ran this command:
docker run -it --rm -v /etc/letsencrypt/master:/etc/letsencrypt -v /etc/letsencrypt/lib:/var/lib/letsencrypt -v /etc/letsencrypt/log:/var/log/letsencrypt -v /tmp:/data/letsencrypt certbot/certbot certonly --webroot --agree-tos --webroot-path=/data/letsencrypt -m xxx@xxxx.com -d www.domain.top
It produced this output:
DNS problem: looking up A for www.domain.top: DNSSEC: DNSKEY Missing; DNS problem: server failure at resolver looking up AAAA for www.domain.top
My web server is (include version):
nginx
The operating system my web server runs on is (include version):
centos8
My hosting provider, if applicable, is:
gname
I can login to a root shell on my machine (yes or no, or I don't know):yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):latest
Domain name registrar customer service:
Hello, the status of your domain name shown here is normal. The domain name has not been set up with the above dnssec. The resolution of the domain name shown here is also effective. It is recommended that you contact the relevant SSL certificate party to inquire about related issues.
Me too. It seems that many people who using the TOP domain name have encountered the same problem recently. My domain name application certificate was normal before, but the same error occurred when I applied for update today. I didn't change any settings in domain registrar and DNS resolution.I ues namesilo for domain register and cloudflare for DNS.
I noticed there is a news on nic.top, I don't know if this is the reason
According to the "Policy and Practice Statement" for the international top-level domain ".top," the new round of .top domain KSK keys will enter the rollover cycle on March 1, 2024. The old KSK key (Keytag: 56384) will be officially deprecated on March 31, 2024, Beijing time.
If the recursive server (or some browsers) you manage has enabled DNSSEC validation and uses the .top domain as a trust anchor (using the trusted-keys directive), please remove the .top domain trust anchor configuration from the recursive server before March 31, 2024, Beijing time. Set the new KSK key as the trust anchor and re-enable it after the old KSK key-related records have expired in the cache to maintain the continuity of the recursive server service.
This website did not report any error. I repeated the issue on my own .top domain (us1.expli.top) (with dnssec correctly configured and successfully request a certificate from zerossl a few minutes ago). May be there are something wrong with the DNS server LetsEncrypt use?
I am having the same problem too. I have 90 .top domains here which fail to get SSL cert and I am unable to get it due to this error. The error message is the same like in the original post. I cannot post any domain name here since those are domains for adult audience only.
The issue was acknowledged by LE staff. While I can sympathize with the frustration, posting “me too” without providing additional details that haven't been provided before—won't get this fixed faster. It's just annoying for anyone who keeps track of this topic.
If one wants to get notified about the progress—there's a handy button with a bell at the bottom of the topic.
We are still investigating. The problem does appear to be with the .top nameservers, and we are attempting to contact the .top operators for more information.
The DNSKEY error may be a slight red-herring, which we are also still investigating.
Unfortunately we don't have good news at this time. For users with a .top domain, you may want to consider trying another Certificate Authority in the meantime.
