Unable to obtain Let's Encrypt SSL certificate [...] Error getting validation data

The validation server is completely unaffected by those headers. There may have been an issue with the web server configuration, and the settings for those headers may have been involved (for example, issues with how the location blocks in the Nginx configuration were arranged), but the headers have no direct bearing on the validation server.

In general, you can and (often) should use CSP and HSTS.

HPKP is dangerous and difficult to configure safely. When pinning CA roots, you should pin more than 1, and, well, Let's Encrypt is only one CA. When pinning certificate keys, some popular Let's Encrypt clients may prefer to always generate new keys and make it difficult to use a specific one, but you certainly can; you may just have to configure something or switch clients.

It's not possible for a CA to be inherently incompatible with CSP, HPKP or HSTS, except that it may be difficult to pin a CA's root or intermediate certificates if they don't consistently use the same ones.

1 Like