Common Issues

Client specific issues

Certbot

You receive the following error:

An unexpected error occurred:
AttributeError: can't set attribute

Your Certbot client is outdated. Older clients (2.1.0 or older) do not properly handle error messages produced by ACME servers. You can still view the error message by opening /var/log/letsencrypt/letsencrypt.log and looking for urn:ietf:params:acme:error: We strongly recommend upgrading your client to a later version as several issues can arise when using this version of Certbot.

General issues

We will go over several (but not all) error messages that the server can return.

404 Response

An unexpected error occurred:
acme.errors.ClientError: <Response [404]>

While the formatting of this response may differ per client (above is Certbot) any 404 response means you are not using the correct ACME server URL for your product. You most likely forgot to add the product at the end of the URL. For more information read the introduction text found here.

Unsupported Identifier

urn:ietf:params:acme:error:unsupportedIdentifier
Identifier tld(s) unsupported for: example.bad-tld

You probably misspelled the TLD for the domain you are ordering a certificate for as it is not in the list of known suffixes.

Rejected Identifier

urn:ietf:params:acme:error:rejectedIdentifier
Identifier tld(s) rejected for: example.banned-tld

The TLD you are using is not allowed. This request will never succeed.

urn:ietf:params:acme:error:rejectedIdentifier
Identifier domain(s) not allowed by whitelist: example.com

The requested domain is not on the whitelist.
This can happen if you have whitelisted domains for a specific relation (organization). Any domains not on this whitelist will get rejected.

Maximum SANs exceeded

urn:ietf:params:acme:error:malformed
This order exceeds the maximum number of allowed SANs

The selected product type does not support the amount of SANs you are requesting. Please refer to the product list on the ACME automation page to find a suitable product.

SAN product required

urn:ietf:params:acme:error:malformed
Invalid product. Based on the identifiers this order needs a san product

The selected product type does not support SANs but your request requires a SAN certificate. Please refer to the product list on the ACME automation page to find a suitable product.

Wildcard product required

urn:ietf:params:acme:error:malformed
Invalid product. Based on the identifiers this order needs a wildcard product

The selected product type does not support wildcards but your request requires a wildcard certificate. Please refer to the product list on the ACME automation page to find a suitable product.

Organization not validated

urn:ietf:params:acme:error:malformed
You are ordering an 'OV' or 'EV' certificate but your organization has not been validated yet

Your organization has to be verified before you can order an OV certificate. If you have seen this error we will have already dispatched organization validation for the organization that is related to the order and you will be contacted within 24 hours. For more information you can contact support@networking4all.com.

ARI specific

urn:ietf:params:acme:error:alreadyReplaced
The certificate referenced by replaces has already been replaced

Your client indicated it's current order is replacing an existing certificate you ordered previously but that certificate was replaced by another order already.

urn:ietf:params:acme:error:unauthorized
The certificate referenced by replaces does not belong to this account

Your client indicated it's current order is replacing an existing certificate you ordered previously but the referenced certificate is not owned by your account.

urn:ietf:params:acme:error:malformed
The certificate referenced by replaces could not be found

Your client indicated it's current order is replacing an existing certificate you ordered previously but the referenced certificate could not be found.

urn:ietf:params:acme:error:malformed
The certificate referenced by replaces shares no identifiers with this order

Your client indicated it's current order is replacing an existing certificate you ordered previously but the new order shares no domains with the existing certificate.

Order still processing

urn:ietf:params:acme:error:orderNotReady
Order is still processing

Your client tried to retrieve the certificate for an order that is still being processed. Please contact us at acme@networking4all.com if this issue ever arises and mention the client you are using.