# Error running auto ssl **URL:** \ **Category:** Help\ **Created:** [July 13, 2023, 9:51pm UTC](https://community.letsencrypt.org/t/error-running-auto-ssl/201776 "2023-07-13T21:51:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![franciscostma](https://avatars.discourse-cdn.com/v4/letter/f/a8b319/32.png) [@franciscostma](https://community.letsencrypt.org/u/franciscostma)\ **Post date:** [July 13, 2023, 9:51pm UTC](https://community.letsencrypt.org/t/error-running-auto-ssl/201776/1 "2023-07-13T21:51:24Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [jmdavidson.com](http://jmdavidson.com) I ran this command: not command i try run auto ssl in one of my domains It produced this output: 3:10:52 PM Analyzing “[jmdavidson.com](http://jmdavidson.com)”’s DCV results … 3:10:53 PM SUCCESS Let’s Encrypt DCV for “[cpcontacts.jmdavidson.com](http://cpcontacts.jmdavidson.com)” is valid until 7/15/23, 12:14 PM UTC. SUCCESS “Let’s Encrypt™” DCV OK: [cpcontacts.jmdavidson.com](http://cpcontacts.jmdavidson.com) SUCCESS Let’s Encrypt DCV for “[cpanel.jmdavidson.com](http://cpanel.jmdavidson.com)” is valid until 7/28/23, 6:14 PM UTC. SUCCESS “Let’s Encrypt™” DCV OK: [cpanel.jmdavidson.com](http://cpanel.jmdavidson.com) SUCCESS Let’s Encrypt DCV for “[mail.jmdavidson.com](http://mail.jmdavidson.com)” is valid until 7/22/23, 12:14 AM UTC. SUCCESS “Let’s Encrypt™” DCV OK: [mail.jmdavidson.com](http://mail.jmdavidson.com) SUCCESS Let’s Encrypt DCV for “[jmdavidson.com](http://jmdavidson.com)” is valid until 7/17/23, 12:14 AM UTC. SUCCESS “Let’s Encrypt™” DCV OK: [jmdavidson.com](http://jmdavidson.com) 3:10:55 PM WARN “Let’s Encrypt™” HTTP DCV error ([cpcalendars.jmdavidson.com](http://cpcalendars.jmdavidson.com)): 400 urn:ietf:params:acme:error:dns (There was a problem with a DNS query) (DNS problem: looking up CAA for [cpcalendars.jmdavidson.com](http://cpcalendars.jmdavidson.com): DNSSEC: Bogus) WARN “Let’s Encrypt™” HTTP DCV error ([webdisk.jmdavidson.com](http://webdisk.jmdavidson.com)): 400 urn:ietf:params:acme:error:dns (There was a problem with a DNS query) (DNS problem: looking up CAA for [webdisk.jmdavidson.com](http://webdisk.jmdavidson.com): DNSSEC: Bogus) WARN “Let’s Encrypt™” HTTP DCV error ([webmail.jmdavidson.com](http://webmail.jmdavidson.com)): 400 urn:ietf:params:acme:error:dns (There was a problem with a DNS query) (DNS problem: looking up CAA for [webmail.jmdavidson.com](http://webmail.jmdavidson.com): DNSSEC: Bogus) WARN “Let’s Encrypt™” HTTP DCV error ([www.jmdavidson.com](http://www.jmdavidson.com)): 400 urn:ietf:params:acme:error:dns (There was a problem with a DNS query) (DNS problem: looking up CAA for [www.jmdavidson.com](http://www.jmdavidson.com): DNSSEC: Bogus) WARN AutoSSL failed to create a new certificate order because the server’s Let’s Encrypt account ([https://acme-v02.api.letsencrypt.org/acme/acct/1020553397](https://acme-v02.api.letsencrypt.org/acme/acct/1020553397)) has reached a rate limit. (429 urn:ietf:params:acme:error:rateLimited (The request exceeds a rate limit) (Error creating new order :: too many failed authorizations recently: see [Failed Validation Limit - Let's Encrypt](https://letsencrypt.org/docs/failed-validation-limit/))) You may contact Let’s Encrypt to request a change to this rate limit. ERROR “Let’s Encrypt™” general error ([webdisk.jmdavidson.com](http://webdisk.jmdavidson.com)): A rate limit prevents DCV. ERROR “Let’s Encrypt™” general error ([www.jmdavidson.com](http://www.jmdavidson.com)): A rate limit prevents DCV. ERROR “Let’s Encrypt™” general error ([webmail.jmdavidson.com](http://webmail.jmdavidson.com)): A rate limit prevents DCV. ERROR “Let’s Encrypt™” general error ([cpcalendars.jmdavidson.com](http://cpcalendars.jmdavidson.com)): A rate limit prevents DCV. AutoSSL will request a new certificate. 3:10:55 PM The system will attempt to renew the SSL certificate for ([jmdavidson.com](http://jmdavidson.com): [jmdavidson.com](http://jmdavidson.com) [mail.jmdavidson.com](http://mail.jmdavidson.com) [cpanel.jmdavidson.com](http://cpanel.jmdavidson.com) [cpcontacts.jmdavidson.com](http://cpcontacts.jmdavidson.com)). Certificate #1: “[jmdavidson.com](http://jmdavidson.com)” and 3 other domains Creating certificate order … 3:10:56 PM WARN Net::ACME2:❌:ACME: “[https://acme-v02.api.letsencrypt.org/acme/finalize/1020553397/193351539167”](https://acme-v02.api.letsencrypt.org/acme/finalize/1020553397/193351539167%E2%80%9D) indicated an ACME error: 403 Forbidden (403 urn:ietf:params:acme:error:caa (CAA records forbid the CA from issuing) (Error finalizing order :: Rechecking CAA for "[cpanel.jmdavidson.com](http://cpanel.jmdavidson.com)" and 2 more identifiers failed. Refer to sub-problems for more information) (dns/cpanel.jmdavidson.com: 403 urn:ietf:params:acme:error:caa (CAA records forbid the CA from issuing) (Error finalizing order :: While processing CAA for [cpanel.jmdavidson.com](http://cpanel.jmdavidson.com): DNS problem: looking up CAA for [cpanel.jmdavidson.com](http://cpanel.jmdavidson.com): DNSSEC: Bogus), dns/mail.jmdavidson.com: 403 urn:ietf:params:acme:error:caa (CAA records forbid the CA from issuing) (Error finalizing order :: While processing CAA for [mail.jmdavidson.com](http://mail.jmdavidson.com): DNS problem: looking up CAA for [mail.jmdavidson.com](http://mail.jmdavidson.com): DNSSEC: Bogus), dns/cpcontacts.jmdavidson.com: 403 urn:ietf:params:acme:error:caa (CAA records forbid the CA from issuing) (Error finalizing order :: While processing CAA for [cpcontacts.jmdavidson.com](http://cpcontacts.jmdavidson.com): DNS problem: looking up CAA for [cpcontacts.jmdavidson.com](http://cpcontacts.jmdavidson.com): DNSSEC: Bogus))). at /usr/local/cpanel/Cpanel/SSL/Auto/Run/User.pm line 393. My web server is (include version): The operating system my web server runs on is (include version): CentOS v7.9.2009 STANDARD kvm My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): I'm using a control panel to manage my site (no, or provide the name and version of the control panel): cpanel whm 110.0.7 The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 13, 2023, 10:13pm UTC](https://community.letsencrypt.org/t/error-running-auto-ssl/201776/2 "2023-07-13T22:13:57Z")
As the error message says, the DNSSEC for your domain is not working properly. CAA records need to be checked in order to issue a certificate, and while it's fine to not have CAA records, the DNS server needs to correctly return that it doesn't have any records rather than returning erroneous data. See the "CAA Errors" section of the Let's Encrypt documention: > **[Certificate Authority Authorization (CAA) - Let's Encrypt](https://letsencrypt.org/docs/caa/#caa-errors)** > > CAA is a type of DNS record that allows site owners to specify which Certificate Authorities (CAs) are allowed to issue certificates containing their domain names. It was standardized in 2013 by RFC 6844 to allow a CA “reduce the risk of... This is something that only your DNS provider can fix (or by switching to a DNS provider that knows what they're doing). And if you're using Network Solutions as your DNS provider, many people have found [that they don't know how to run a DNS server](https://community.letsencrypt.org/t/ongoing-dnssec-caa-network-solutions-issues-blocking-http-01-renewals/201531). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 12, 2023, 10:14pm UTC](https://community.letsencrypt.org/t/error-running-auto-ssl/201776/3 "2023-08-12T22:14:35Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.