My domain is: o----o.de I ran this command: certbot certonly -c certonly.ini -d www.o----o.de -d o----o.de The certonly.ini contains manual preferred-challenges http manual-auth-hook /path/to/authenticator.sh manual-cleanup-hook /path/to/cleanup.sh manual-public-ip-logging-ok It produced th…

@lestaff Any idea why this domain name is being refused? As far as I can tell from RFC 5891, the hyphen restriction is only applicable to unicode strings being converted to IDNA labels? And not for non-IDNA domains?

The IDNA RFC reserves all hostnames containing: [image] RFC 5890: Internationalized Domain Names for Applications (IDNA): Definitions... This document is one of a collection that, together, describe the protocol and usage context for a revision of Internationalized Domain Names for App…

Test result for o----o.de: Error 1 unique issue(s) detected (IssueFromLetsEncrypt)

Hm, so the BR is very strict, even if the RFCs allow it. Good to know, not so good for @ToP unfortunately.

Yeah, Let's Encrypt even specifically had an Official Incident in the past where they failed to block issuance where characters 2, 3, and 4 were all hyphens: [image] 2021.10.11 Certificate Mis-Issuance related to Internationalized Domain Names (IDN) formatting Incidents S…

Uch, I don't seem to be able to find any actual arguments for those changes.. SC48 - Domain Name and IP Address Encoding (#285) by castillar · Pull Request #302 · cabforum/servercert · GitHub is just the effective change in code and SC48 - Domain Name and IP Address Encoding by CBonnell · Pull Reque…

[image] Osiris: I don't seem to be able to find any actual arguments for those changes I think there's some discussion in the CAB mailing list: https://lists.cabforum.org/pipermail/servercert-wg/2021-July/thread.html My quick read-through (which may be wrong) is that since some people thoug…

That sounds like a stupid reason.. :roll_eyes:

Thank you for your answers. I have researched at DENIC. Also at DENIC it is no longer possible to register domains with -- in 3rd and 4th position. But in the past it was possible and so such domains exist. It would be a pity if the owners of this domain cannot use a certificate.

Well, the owners of this domain cannot use a certificate from any public CA. Yes, that is a pity.

Error reserved format (R-LDH: '?--') creating certificate for www.o----o.de

Help

petercooperjr July 26, 2022, 8:14pm 6

Yeah, Let's Encrypt even specifically had an Official Incident in the past where they failed to block issuance where characters 2, 3, and 4 were all hyphens:

Topic		Replies	Views
Trying to find what cert contains a R-LDH domain Help	5	2466	August 31, 2017
Invalid character in DNS name: www.-----2016.artur-aviv.com Issuance Policy	13	6863	March 1, 2017
An unexpected error occurred. Please help Help	13	971	February 18, 2023
Cannot verify international character domain Help	2	367	July 22, 2025
2021.10.11 Certificate Mis-Issuance related to Internationalized Domain Names (IDN) formatting Incidents	0	1134	October 13, 2021

Error reserved format (R-LDH: '?--') creating certificate for www.o----o.de

Related topics