# I cant update my SSL for my domain **URL:** \ **Category:** Help\ **Created:** [March 2, 2025, 12:49am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484 "2025-03-02T00:49:31Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rkaraca](https://avatars.discourse-cdn.com/v4/letter/r/cc9497/32.png) [@rkaraca](https://community.letsencrypt.org/u/rkaraca)\ **Post date:** [March 2, 2025, 12:49am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/1 "2025-03-02T00:49:31Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [kxan36news.com](http://kxan36news.com) I ran this command: I try to get an SSL for my domain but l get this error : Saving debug log to /var/log/letsencrypt/letsencrypt.log Requesting a certificate for [kxan36news.com](http://kxan36news.com) and [www.kxan36news.com](http://www.kxan36news.com) An unexpected error occurred: The server will not issue certificates for the identifier :: Error creating new order :: Cannot issue for "[kxan36news.com](http://kxan36news.com)": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy (and 1 more problems. Refer to sub-problems for more information.) Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. It produced this output: My web server is (include version): webmin 2.202 The operating system my web server runs on is (include version): ubuntu 24 My hosting provider, if applicable, is: Hetzner I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel):webmin The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [March 2, 2025, 1:07am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/2 "2025-03-02T01:07:18Z")
> [@rkaraca](#): > > forbidden by policy This usually means the domain is in the special list of protected domains, or you're in treasury's sdn list. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [March 2, 2025, 1:17am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/3 "2025-03-02T01:17:27Z")
And this is what I am seeing for DNS ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/3/2/3274c79ee97031eecce62e19d1f07e6ce6659ebc.png) ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [March 2, 2025, 1:27am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/4 "2025-03-02T01:27:37Z")
> [@Having issue with letsencrypt](https://community.letsencrypt.org/t/having-issue-with-letsencrypt/140855/7): > > W… > We have blocked issuance to the domain in question for legal reasons. The only information I can provide about the situation is that we have strong reason to believe that it is closely associated with a [Specially Designated National](https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists) entity. but you have like 3 different valid certificates from different CAs when I looked at crt.sh, where all of those gone? ---
**Author:** ![rkaraca](https://avatars.discourse-cdn.com/v4/letter/r/cc9497/32.png) [@rkaraca](https://community.letsencrypt.org/u/rkaraca)\ **Post date:** [March 2, 2025, 8:08am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/5 "2025-03-02T08:08:29Z")
I dont understand very much about what you are saying. what should l do? please advise me. ---
**Author:** ![rkaraca](https://avatars.discourse-cdn.com/v4/letter/r/cc9497/32.png) [@rkaraca](https://community.letsencrypt.org/u/rkaraca)\ **Post date:** [March 2, 2025, 8:09am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/6 "2025-03-02T08:09:07Z")
what that means? ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [March 2, 2025, 9:07am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/7 "2025-03-02T09:07:12Z")
It means you're under sanctions from the us government and companies in the us can't do business with you. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 2, 2025, 9:55am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/8 "2025-03-02T09:55:03Z")
~~If `kxan36news.com` is one of the domain names of [KXAN-TV - Wikipedia](https://en.wikipedia.org/wiki/KXAN-TV) (not sure, didn't check, domains nameservers are also currently broken), I'm preeeeetty sure they're not on the SDN list of the US Treasury.~~ ~~I think it's more likely KXAN and variants thereof have been tagged as high risk. We should wait for a Let's Encrypt crewmember for more information.~~ See below. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [March 2, 2025, 10:10am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/9 "2025-03-02T10:10:33Z")
the thread I linked is about this exact domain, so I think ISRG do think this domain is from someone on SDN. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 2, 2025, 10:16am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/10 "2025-03-02T10:16:21Z")
Ah, wow, that's interesting. I didn't check if a thread from 5 years ago literally matched the domain name of _this_ thread 🤣 Thanks for the clarification. And with "closely associated" it makes sense it wouldn't be found directly on the SDN. I guess the domain owners legal team should contact the LE legal team for clarification, if they want that (again?) 5 years later. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 1, 2025, 10:17am UTC](https://community.letsencrypt.org/t/i-cant-update-my-ssl-for-my-domain/234484/11 "2025-04-01T10:17:07Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.