I am unable to acquire a LE certificate, via GitLab Pages, for “norfolkNeighbourhoodWatch.co.UK”

Help
1

My Domain

norfolkNeighbourhoodWatch.co.UK

Your template cited crt.sh, [1] which I attempted to visit. However, I am unable to:

    1. https://crt.sh/?q=norfolkneighbourhoodwatch.co.uk

    2. Not Found

      The requested URL was not found on this server.

      Apache Server at crt.sh Port 443

    1. https://crt.sh/?q=google.com

    2. 502 Bad Gateway

      nginx

What The Problem Is

At gitLab.com/neighbourhood-watch-network/association-nfk/gitlab-profile/pages/domains/norfolkNeighbourhoodWatch.co.UK, upon my first attempt, and when I select “Retry”, I observe:

  1. GitLab is obtaining a Let's Encrypt SSL certificate for this domain. This process can take some time. Please try again later.

  2. Something went wrong while obtaining the Let's Encrypt certificate.

gitLab.com/gitLab-org/gitlab/-/work_items/543733 recommends letsDebug.net, which succeeds:

    1. #!/usr/bin/env sh
curl --data '{"method":"http-01","domain":"norfolkNeighbourhoodWatch.co.UK"}' -H 'content-type: application/json' https://letsDebug.net

    2. {"Domain":"norfolkneighbourhoodwatch.co.uk","ID":3111882}

    1. #!/usr/bin/env sh
curl -H 'accept: application/json' https://letsDebug.net/norfolkneighbourhoodwatch.co.uk/3111882 | yq -P

    2.   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
100    249 100    249   0      0   1128      0                              0
id: 3111882
domain: norfolkneighbourhoodwatch.co.uk
method: http-01
status: Complete
created_at: "2026-08-17T11:35:34.225033Z"
started_at: "2026-08-17T11:35:34.227271Z"
completed_at: "2026-08-17T11:35:40.005741Z"
result:
  ok: true

At letsdebug.net/norfolkneighbourhoodwatch.co.uk/3111877, it recommends community.letsencrypt.org:

No issues were found with norfolkneighbourhoodwatch.co.uk. If you are having problems with creating an SSL certificate, please visit the Let's Encrypt Community forums and post a question there.

My Web-Server

GitLab Pages, at gitLab.com, whose /help endpoint returns:

GitLab Enterprise Edition 19.3.0-pre 342d582a650

The operating system my web server runs on is (include version):

I do not know.

My Hosting-Provider

Hostinger UK Limited (11737257)

Whether I Am Able To Log-On To A Superuser Shell

I do not know, but do not expect so.

Whether, And, If So, Which, Control Panel I Am Using

“Hpanel”

The Version Of My Client

e.g. output of certbot --version or certbot-auto --version if you're using Certbot

This appears to be inapplicable.

  1. Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

    ↩︎
2

Have you tried GitLab's troubleshooting guide for this issue (GitLab Pages Let’s Encrypt certificates | GitLab Docs)? In particular, have you tried removing the AAAA record (IPv6 address)?

3

from ct log you are using Google Trust Services as CA for those domains. have you seen the log for what actually errored? Normal renewal cycle (most likely 30 days before expire) won't come until a week later, so it's possible that Hostinger panel itself handle certificate and gitlab's acme menu is not connected to anything.

4

@MaxHearnden, yes. I've provided more detail in a GitLab Work Item:

However, the previous A record was an IPv4 address: 2.57.91.91.

5

@orangepizza, not to my knowledge, although I didn't initially configure this domain, and am very much a novice, so it's perhaps possible. Until I replaced its CNAME, TXT, and A records, it was connected to a Google Sites deployment. However, having removed those values, surely it shouldn't remain connected to Google in any manner?

6

In retrospect, because I've not yet TL1:

…that appears to be known:

Though, I did file an issue specifically for it, before I realised:

Apologies for the tangent.

7

Yeah, crt.sh is pretty broken and probably the help template shouldn't mention it. There are other tools available for searching Certificate Transparency logs if you're looking for that. But really the message is just there in the template to make sure people know that hiding their domain name here makes it much harder for people to help them, and that "the bad guys" know their domain name already.

Without knowing the actual error that Gitlab is running into, it's hard to give more specific advance than to make sure that your domain name works and is accessible to the Internet.

8

@petercooperjr, I'm not dogma-bound to GitLab's automatic renewal, but the thought of needing to manually renew an alternative every 90 days isn't pleasant. I don't know of any free infrastructure that would allow me to auto-query GitLab and ZeroSSL (or whoever else)'s APIs to create an ad-hoc replacement, either; I can't pay for anything, because the organisation that I'm doing this on behalf of has no technical expertise or finances.

9

There might be an issue with capitalisation, have you tried creating the domain all lowercase?

10

@MaxHearnden, that resolved the error!

Screenshot_20260817_152424
Screenshot_20260817_1524241276×1042 232 KB

However, it does not appear to have applied:

Screenshot_20260817_152545
Screenshot_20260817_1525451916×1388 648 KB

(Is this problem outside of the scope of this forum?)

11

Propagation merely required some time:

Screenshot_20260817_153206
Screenshot_20260817_1532061276×693 60.3 KB

Now, all has been solved. Many thanks! I'll update the GitLab work item to specify what the problem is, and I hope that this serves as a solution for anyone experiencing either of these problems: