List of domains blocked with "Policy forbids issuing for name"

[cpu]

Hi @tbehling,

@tbehling

I understand from this forum post there are various “transient” domain names under which Let’s Encrypt will refuse to issue a certificate, which gives the error “Policy forbids issuing for name”.

There are very few of these "transient" domain names (like the EC2 case you mention). 99% of the entries are for large financial institutions and brands you would expect to find on the Alexa top 100 list.

@tbehling

I am working on a project involving Let’s Encrypt and it would be a big win for our users if it were possible to either obtain a copy of this list or query an API to check a domain against it, before trying to request an authorization.

Can you expand on your use-case? Why is it problematic to find out at the time of the new-authz request that the domain doesn't meet the issuance policy requirements?

The new-authz endpoint is an API that you can use to check the domain if you are cognizant of pending authorization limits (this only matters for cases where the domain is allowed and a pending authz is created. None will be created for a domain that the policy blocks).

We do not presently make the list of high-value domain names blocked by the issuance policy public. I don't expect this will change in the short term.

Thanks!