It appears that letsencrypt no longer, as of a couple months ago, validates domains lacking the xxx.domain. com (where xxx is, for example, www). If you try to get a cert for multiple domains and any one of those lacks the first part (the xxx) then the whole cert fails. That’s reasonable. You don’t issue a multi-domain cert if any of the validations for any of the domains fail. That would be fine, however the validation process does not tell you which one fails, nor is there a user friendly explanation anywhere that I could find that lays out an explanation of the true cause and solution.
The obvious solution is to ensure that you always have the xxx part of xxx.domain. com and then ask for the cert.
Further, the validation process doesn’t just look at the DNS record, it appears to look at files on your web server for validation, such as trying to query the domain or writing to files. If a website itself is not configured to use the xxx part of the .com name then the validation will fail in the same way, without explaining what it checked that actually caused the failure, instead it dumps a list of all domains claiming they all fail the validation.
Does anyone have a way around this? I don’t understand why I can’t add a simple domain .com to my cert instead of it requiring that I have xxx part of the to my cert.
I’d appreciate any advice. I’m sorry if I sound dumb in explaining that. It took me a while to figure out what was wrong and cert validation failures caused days of delay due to maximum validation retries (per 24 hours). It was/is frustrating to run into all these issues every 90 days.
Creator of My Talking Hank Mod