@LoNo posted a new topic, subject "Lightsail Letsencrypt Error Cannot issue for "*.domain": Name does not end in a public suffix (.org)". It read:

   Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
    
    My domain is: moneymadeeasyfoundation.org
    
    I ran this command: sudo certbot -d $WILDCARD --manual --preferred-challenges dns certonly
    
    It produced this output: Starting new HTTPS connection (1): supporters.eff.org  
    Obtaining a new certificate  
    An unexpected error occurred:  
    Error creating new order 8b7c:f320:99b9:690f:4595:cd17:293a:c069 Cannot issue for “*.domain”: Name does not end in a public suffix  
    Please see the logfiles in /var/log/letsencrypt for more details.
    
    My web server is (include version): Amazon Lightsail
    
    The operating system my web server runs on is (include version): Ubuntu 16.04.6
    
    My hosting provider, if applicable, is:
    
    I can login to a root shell on my machine (yes or no, or I don't know): Yes using web based SSH
    
    I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
    
    The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

@JuergenAuer (Juergen Auer) replied

    Hi @LoNo
    
    LoNo:
    
    > My domain is: moneymadeeasyfoundation.org
    > 
    > I ran this command: sudo certbot -d $WILDCARD --manual --preferred-challenges dns certonly
    
    looks like your $WILDCARD isn't defined or wrong / incomplete.
    
    What says
    [code] 
        echo $WILDCARD
        
    [/code]

To which @LoNo replied

    when I put in the command echo $WILDCARD
    
    it says *.DOMAIN

@JuergenAuer (Juergen Auer) replied

    LoNo:
    
    > it says *.DOMAIN
    
    There you see the problem. You want to create a certificate with `*.DOMAIN` as domain name. That's not possible.
    
    Use
    [code] 
         sudo certbot -d moneymadeeasyfoundation.org -d *.moneymadeeasyfoundation.org --manual certonly
        
    [/code]
    
    instead. You can remove the `--preferred-challenges` option because a wildcard certificate requires dns validation.

After which, @LoNo added

    awesome it gave me the DNS txt record, just wondering, will this cert auto renew or will I have to do it manually?

@LoNo replied

    Also the tutorial doesn't mention anything about the response I received which says:
    
    Create a file containing just this data:
    
    q7jJfRFQS3goHrvV_olZMUmJQr3taWsYAqQz_ZqVT1M.0fOdkoIn5Zt9nX42t7wuA46WFrr_3EZu7qnIwAyoQjg
    
    And make it available on your web server at this URL:
    
    http://moneymadeeasyfoundation.org/.well-known/acme-challenge/q7jJfRFQS3goHrvV_olZMUmJQr3taWsYAqQz_ZqVT1M
    
    am I supposed to copy the code into a txt file and upload it to a page I create and name the page the provided directory?

So @schoen (Seth Schoen) replied

    LoNo:
    
    > awesome it gave me the DNS txt record, just wondering, will this cert auto renew or will I have to do it manually?
    
    Certbot can't autorenew certificates that require DNS challenges _unless_ you give it a way to create DNS TXT records in your zone without human intervention (because the DNS TXT record will be different for each renewal—just maintaining the original TXT record is of no benefit). You may be able to do this, depending on how your DNS is hosted and whether it can be updated from software.
    
    LoNo:
    
    > am I supposed to copy the code into a txt file and upload it to a page I create and name the page the provided directory?
    
    Yes, that's right. The idea is that the exact URL that was mentioned here has to exist on your site, and it has to have the exact text content that was indicated. So if you're doing that yourself, you might arrange to do that by uploading a text file to your site with that content, under that location.
    
    But for wildcard certificates the validation method will require creating DNS records rather than creating files on your server.
    
    More information about these methods of proving your control of domain names is at
    
    letsencrypt.org
    
    ### Challenge Types - Let's Encrypt
    
    When you get a certificate from Let's Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this validation is handled automatically by your ACME...

After which, @LoNo added

    when I go to setup a DNS record under lightsail it doesn't allow me to point the txt to the specific location, it just lets add a prefix to my domain. Sorry super new to this.

So @schoen (Seth Schoen) replied

    Are you confusing the TXT record (DNS-01 challenge) with the file upload (HTTP-01 challenge)? Did you get a message with a specific TXT record that you have to create?

So @LoNo replied

    This is response I got  
    Create a file containing just this data:
    
    aAgLqUEYMVwhwzquv9Sn4XuGpEcUfwrAo0FejnoWkdI.0fOdkoIn5Zt9nX42t7wuA46WFrr_3EZu7qnIwAyoQjg
    
    And make it available on your web server at this URL:
    
    http://moneymadeeasyfoundation.org/.well-known/acme-challenge/aAgLqUEYMVwhwzquv9Sn4XuGpEcUfwrAo0FejnoWkdI
    
    * * *
    
    Press Enter to Continue
    
    I am using wordpress and lightsail, I don't have a cpanel, and I don't know how to upload the txt file, It asked me to create a DNS record which I did and I checked on mxtoolbox and it says that one is okay. I just don't know what to do with the above response

Then @JuergenAuer (Juergen Auer) said

    Looks like you have startet two different commands. One with the wildcard -> dns-challenge, one with the main domain -> http-challenge.
    
    That's wrong. You need one command with both domain names -> you have to create two TXT entries with the same name, but different values.
    
    Result: You have one certificate with two domain names. Not two certificates with one domain name.

So @LoNo replied

    Thats what the tutorial was saying, but it didn't give me the second txt entry it just told me to make the txt file, how do I start the command again for the 2nd txt entry.

Then @mnordhoff (Matt Nordhoff) said

    It's not invalid to use DNS validation for one name and HTTP validation for the other name, it's just unusual.
    
    You can add `--preferred-challenges dns` to make Certbot to use DNS for both.
    
    You should really use automated validation if at all possible.
    
    Do you **really** need a wildcard certificate? Let's Encrypt certificates can have up to 100 names, and you can get many certificates.
    
    You're using Amazon Route 53 DNS, which has a good API that is supported by Certbot, but I don't know if Lightsail gives access to the API.

So @LoNo replied

    No I think lightsail is pretty limited, I don't know if there is an integrate transfer system setup to push lightsail into AWS and route 53, currently the domains are registered with godaddy, but all the DNS & networking is setup in lightsail.
    
    I was just following the lightsail tutorial on how to setup letsencrypt and thats what it was telling me.

After which, @system (system) added

    This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.


{'source': 'discourse', 'url': 'https://community.letsencrypt.org/t/lightsail-letsencrypt-error-cannot-issue-for-domain-name-does-not-end-in-a-public-suffix-org/99969', 'title': 'Lightsail Letsencrypt Error Cannot issue for "*.domain": Name does not end in a public suffix (.org)', 'views': 5499, 'has_accepted_answer': True, 'word_count': 1097, 'like_count': 1, 'reply_count': 10, 'participant_count': 4, 'posts': 15, 'tags': '', 'author': '@LoNo', 'participants': '@LoNo, @JuergenAuer (Juergen Auer), @schoen (Seth Schoen), @mnordhoff (Matt Nordhoff), @system (system)', 'image_url': [None], 'created_at': '2019-08-15T17:25:30.514Z', 'last_posted_at': '2019-09-14T18:51:27.059Z'}