Hi, I work at Yandex, an international internet company.
I'm reaching out because we're experiencing an issue issuing certificates for our domain yandex.ru. Even after removing/specifying the CAA records on our domain, certificate issuance still fails with the error "forbidden by policy."
For reference, here is an example demonstrating the issue:
How can we run a blocklist removal procedure?
Thank you very much for your assistance.
"Forbidden by policy" generally means one of two things:
- Let's Encrypt believes that the organization controlling the domain name is on the US Government's "Specially Designated Nationals list" which legally forbids Let's Encrypt from issuing certificates to them.
- The domain name is on a "high risk" list, of domains that have really high usage and haven't otherwise shown an interest in using Let's Encrypt certificates. They have a process for such organizations to request starting to use Let's Encrypt, though it involves getting lawyers involved.
For Yandex specifically, I don't know which of those (or both!) might be the case. But my guess would be that it's one of those.
It's case (2) here. Email us.