# Forbidden by policy error generating the let’s encrypt certificate
**URL:** https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208
**Category:** Help
**Created:** [May 12, 2026, 9:55pm UTC](https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208 "2026-05-12T21:55:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Crawl](https://community.letsencrypt.org/u/Crawl)
#### Post date: [May 12, 2026, 9:55pm UTC](https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208/1 "2026-05-12T21:55:57Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: [team-test.absolutbank.ru](http://team-test.absolutbank.ru) and [team2.absolutbank.ru](http://team2.absolutbank.ru)
I ran this command:
certbot certonly --manual -d [team2.absolutbank.ru](http://team2.absolutbank.ru) --preferred-challenges dns --key-type rsa
and
certbot certonly --manual -d [team-test.absolutbank.ru](http://team-test.absolutbank.ru) --preferred-challenges dns --key-type rsa
It produced this output:
[31mAn unexpected error occurred: -[0m
[31mError creating new order :: Cannot issue for
"[team2.absolutbank.ru](http://team2.absolutbank.ru)": The ACME server refuses to issue a certificate for this domain name,
because it is for
bidden by policy--[0m
My web server is (include version):
Windows Server 2012 R2
The operating system my web server runs on is (include version):
My hosting provider, if applicable, is: nope
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): -
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 2.9.0
---
### Author:  [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)
#### Post date: [May 12, 2026, 10:42pm UTC](https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208/2 "2026-05-12T22:42:31Z")
That domain [looks to be registered](https://www.reg.ru/whois/absolutbank.ru) to `Commercial bank "Absolut Bank" (PAO)`, which is on the [United States SDN List](https://sanctionssearch.ofac.treas.gov/Details.aspx?id=45895). The Let's Encrypt Certificate Authority is forbidden by government regulations from doing business with that organization, including by issuing a certificate. You may have better luck with some other CA which isn't under US jurisdiction.
---
### Author:  [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)
#### Post date: [May 14, 2026, 2:27pm UTC](https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208/3 "2026-05-14T14:27:53Z")
Also, completely separately, regardless of the CA you find,
> [@Crawl](#):
>
> Windows Server 2012 R2
That's [only a few months out](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2012-r2) from the end of its third year of extended-extended support.
> [@Crawl](#):
>
> I ran this command:
> certbot
Certbot was only ever in a beta test on Windows, and [was discontinued](https://community.letsencrypt.org/t/certbot-discontinuing-windows-beta-support-in-2024/208101) over two years ago. You probably want to look at [Certify the Web](https://certifytheweb.com/) or [simple-acme](https://simple-acme.com/) instead if you're going to be running a client on Windows.
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [June 13, 2026, 2:28pm UTC](https://community.letsencrypt.org/t/forbidden-by-policy-error-generating-the-let-s-encrypt-certificate/247208/4 "2026-06-13T14:28:21Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.