Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
The operating system my web server runs on is (include version): Windows Server 2019
I can login to a root shell on my machine (yes or no, or I don't know): I don't know
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Certify The Web
Iām using CertifyTheWeb GUI. The process is supposed to be automated and works for other domains when I run but this error on this domain is preventing me from renewing the certificate.
Hi, I'm the developer of Certify The Web. So it looks like you are trying to get a cert for uoflplannedgifts.org, can you please clarify if the typo uofplannedgifts.org is also intended to be included in your certificate? If so it needs to be a real domain that points to the same server (so the app can respond for both variants of the domain).
Let's Encrypt will take the list of domains you say you want on your cert and expect you to provide an http response one each domain, if you can't do that validation fails and then you don't get a cert.
I recommend setting a hostname on your exiting http bindings in IIS so that the app can pick those up and an automatically identify the domains to include on your cert, that way you don't get typos.
I note also that your server currently responds with the cert for a different website - make sure you are not defining a binding anywhere that specifically binds your server IP to a given cert, as that will take priority over SNI (server name indication) bindings. IIS often nags you to create a "Default" SSL binding, but don't do it unless you specifically need it as it's arguably better for your site to have no cert/https configured than to have it wrongly configured. In general don't use non-SNI (or empty hostname) bindings unless you have a very specific reason and completely understand the implications.
Looks like I got past the initial error for this domain (and others) but now I'm receiving the following across
The ACME CA service did not issue a valid certificate in the time allowed. Failed to finalize certificate order: Error finalizing order :: While processing CAA for uoflplannedgifts.org - the domain's nameservers may be malfunctioning
