My domain name cannot apply for Let's Encrypt SSL certificate on any platform

I believe the problem is a mixture of two issues:

To begin with, your nameservers do not support “0x20” (reflecting mixed-case query names in responses). More info here.

This is not usually a fatal problem, but it does mean that Let’s Encrypt’s DNS recursive resolver goes into a “0x20 fallback” mode, where it compares the response from every nameserver, to make sure that no spoofing is going on.

That brings us to the second issue: when Let’s Encrypt’s resolver is performing the fallback queries, it is hitting an internal maximum number of queries it is willing to perform in order to complete the fallback, and this results in the target domain not being successfully resolved.

I think the reason it is hitting that limit is that you effectively have 9 (or 16 according to glue records) nameservers (ns1.hwclouds-dns.com and ns1.hwclouds-dns.net each advertise multiple IPv4 addresses and an IPv6 address).

For context, here is a snippet from a similarly configured resolver:

[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.net. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.com. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request lingxh.com. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.com. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.net. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.net. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request ns1.hwclouds-dns.net. has exceeded the maximum number of glue fetches 66
[1592100791] libunbound[27661:0] debug: request hwclouds-dns.net. has exceeded the maximum number of glue fetches 66
[1592100792] libunbound[27661:0] debug: request hwclouds-dns.com. has exceeded the maximum number of glue fetches 66
[1592100796] libunbound[27661:0] debug: request b.lingxh.com. has exceeded the maximum number of glue fetches 17 to a single delegation point

To resolve it, I think you should just find some nameservers that do support 0x20 mixed case. While the behavior of Let’s Encrypt’s resolvers in this case appears to be pretty crappy, I don’t think there’s going to be any other resolution.

2 Likes