# The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy

**URL:** <https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994>\
**Category:** Help\
**Created:** [May 7, 2020, 9:06am UTC](https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994 "2020-05-07T09:06:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AlexanderDemidov](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@AlexanderDemidov](https://community.letsencrypt.org/u/AlexanderDemidov)\
**Post date:** [May 7, 2020, 9:06am UTC](https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994/1 "2020-05-07T09:06:06Z")

</div>

Hello,

I try to get certificate for domain “[marathon9may.rncb.ru](http://marathon9may.rncb.ru)”, but receive error “The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy”.

My domain is:

> **[День Победы Онлайн для клиентов РНКБ](http://marathon9may.rncb.ru)**
>
> День Победы Онлайн для клиентов РНКБ — мастер-классы и игры для детей!

I ran this command:  
dehydrated --domain [marathon9may.rncb.ru](http://marathon9may.rncb.ru) -c

It produced this output:  
Processing [marathon9may.rncb.ru](http://marathon9may.rncb.ru)

- Signing domains…
- Generating private key…
- Generating signing request…
- Requesting authorization for [marathon9may.rncb.ru](http://marathon9may.rncb.ru)…
- ERROR: An error occurred while sending post-request to [https://acme-v01.api.letsencrypt.org/acme/new-authz](https://acme-v01.api.letsencrypt.org/acme/new-authz) (Status 400)

Details:  
HTTP/1.1 100 Continue

HTTP/1.1 400 Bad Request  
Server: nginx  
Date: Thu, 07 May 2020 08:52:09 GMT  
Content-Type: application/problem+json  
Content-Length: 212  
Connection: keep-alive  
Boulder-Requester: 23959142  
Cache-Control: public, max-age=0, no-cache  
Replay-Nonce: 0101L\_4jDf3QZVmTLWAXIEp13dw3x2kV-Z34dM2vjNqEI9g

{  
“type”: “urn:acme:error:rejectedIdentifier”,  
“detail”: “Error creating new authz :: The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy”,  
“status”: 400  
}

My web server is (include version):  
openresty/1.13.6.1

The operating system my web server runs on is (include version):  
CentOS release 6.9

My hosting provider, if applicable, is:  
AWS

I can login to a root shell on my machine (yes or no, or I don’t know):  
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):  
no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot):  
Dehydrated version: 0.6.5

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 7, 2020, 9:16am UTC](https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994/2 "2020-05-07T09:16:52Z")

</div>

Hi @AlexanderDemidov

> [@AlexanderDemidov](#):
>
> “The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy”.

some domain names are blocked.

Read

> [@Domain Forbidden](https://community.letsencrypt.org/t/domain-forbidden/112059/2):
>
> H…

there is a mail address you can use to ask.

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [May 7, 2020, 9:20am UTC](https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994/3 "2020-05-07T09:20:09Z")

</div>

In this case, Let’s Encrypt might not be able to do anything, because the domain is on the OFAC sanction list: [https://letsdebug.net/marathon9may.rncb.ru/134359](https://letsdebug.net/marathon9may.rncb.ru/134359)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 6, 2020, 9:20am UTC](https://community.letsencrypt.org/t/the-acme-server-refuses-to-issue-a-certificate-for-this-domain-name-because-it-is-forbidden-by-policy/121994/4 "2020-06-06T09:20:15Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.