Forbidden by policy error generating the let’s encrypt certificate

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: team-test.absolutbank.ru and team2.absolutbank.ru

I ran this command:
certbot certonly --manual -d team2.absolutbank.ru --preferred-challenges dns --key-type rsa
and
certbot certonly --manual -d team-test.absolutbank.ru --preferred-challenges dns --key-type rsa

It produced this output:
[31mAn unexpected error occurred: -[0m
[31mError creating new order :: Cannot issue for
"team2.absolutbank.ru": The ACME server refuses to issue a certificate for this domain name,
because it is for
bidden by policy--[0m
My web server is (include version):
Windows Server 2012 R2
The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: nope

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): -

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.9.0

2

That domain looks to be registered to Commercial bank "Absolut Bank" (PAO), which is on the United States SDN List. The Let's Encrypt Certificate Authority is forbidden by government regulations from doing business with that organization, including by issuing a certificate. You may have better luck with some other CA which isn't under US jurisdiction.

3

Also, completely separately, regardless of the CA you find,

That's only a few months out from the end of its third year of extended-extended support.

Certbot was only ever in a beta test on Windows, and was discontinued over two years ago. You probably want to look at Certify the Web or simple-acme instead if you're going to be running a client on Windows.