forbidden by policy for h-rnd.by and mail.h-rnd.by

Issuance Policy
1

Hello,

I’m trying to understand why Let’s Encrypt refuses to issue certificates for two domains belonging to the same organization:

  • h-rnd.by
  • mail.h-rnd.by

Both domains previously had valid Let’s Encrypt certificates and were successfully used for HTTPS/mail services.

The certificates are no longer renewable. When I try to create a new certificate using win-acme, the ACME server returns:

Error creating new order :: Cannot issue for "h-rnd.by":
The ACME server refuses to issue a certificate for this domain name,
because it is forbidden by policy

The same error occurs for mail.h-rnd.by:

Error creating new order :: Cannot issue for "mail.h-rnd.by":
The ACME server refuses to issue a certificate for this domain name,
because it is forbidden by policy

I also tested this against the Let's Encrypt staging environment, so the result is reproducible without affecting any production certificates or services.

The relevant win-acme output was:

Connecting to https://acme-staging-v02.api.letsencrypt.org/...
Connection OK!

Plugin Manual generated source h-rnd.by with 1 identifiers
Plugin Single created 1 order
[HTTP] Request completed with status BadRequest
Failed to create order: Error creating new order :: Cannot issue for "h-rnd.by":
The ACME server refuses to issue a certificate for this domain name,
because it is forbidden by policy

The same result was obtained for mail.h-rnd.by.

The rejection occurs when creating the ACME order, before any HTTP-01 or DNS-01 validation takes place.

Could you please clarify:

  1. Why are h-rnd.by and mail.h-rnd.by currently forbidden by policy?
  2. Is this related to a sanctions/compliance restriction, a high-risk domain policy, or another internal issuance policy?
  3. Is the restriction applied to the specific domain names, the registrant/organization, or the entire domain hierarchy?
  4. Is there a process for requesting a review or removal of the restriction if it was applied in error?
  5. If the restriction is permanent, is there any public documentation that explains the applicable policy?

I would appreciate any clarification about the specific reason for the rejection. We would like to understand whether this is an issue that can be resolved or whether we need to move to another certificate authority.

Thank you.

2

I don't know as there's a way to tell publicly which it is, unless someone from Let's Encrypt happens to see this and respond here. My guess is a sanctions/compliance restriction, though. It looks like there have been several cases around here where an entity that had been getting Let's Encrypt certificates starts getting blocked, though I don't know if it's because of more additions to the sanctions list or a more thorough way of figuring out which domains are controlled by which sanctioned entities.

You can search if your organization is on the US Sanctions list at https://sanctionssearch.ofac.treas.gov/.

If it's a sanctions-based blocking, then it's the organization, since Let's Encrypt isn't legally allowed to interact with them. (And I suspect that they have to be careful about even responding here to them.)

I'm not sure how they match up the domain names with the organizations, though. It may be that sometimes that matching isn't perfect, but when they're informed of a match they need to stop issuing for them.

If the organization isn't actually on the US sanctions list, then I'm not sure what the process would be other than posting here. If it is on the US sanctions list, then you've got to take that up with the US government.

I think the closest is in the Policy and Legal Repository where you can find the subscriber agreement, which says that parties to the agreement need to comply with the law, including sanctions laws.

3

It's a bit of a stretch, however it could be this (same address).

4

h-rnd.by is owned by ICT Horizont. OJSC Horizont Holding is it's parent company and is on the U.S. OFAC list.

Restrictions are permanent as long as the organization remains on the OFAC list.