#Edge Certificate Pending TXT

46 messages · Page 1 of 1 (latest)

radiant badger
radiant badger
#

I also have multiple domains on CA and none had this issue

#

I also added 3 types of CAA records directed towards letsencrypt.org as I saw in one of the posts

lilac copper
#

My guess is that it's too long: https://community.letsencrypt.org/t/ssl-for-a-63-character-max-number-of-characters-domain-name-s/36387/17
There's a limit of 63 characters in cert common names, you exceed that with the TLD Extension

Let's Encrypt Community Support
SSL for (a) 63 character (max. number of characters) - domain name(s)

Yep, the conclusions in this thread are correct. To summarize: The X.509 Subject field "CommonName" is limited to 64 characters per RFC 5280, pages 120 and 124: CommonName ::= PrintableString (SIZE (1..ub-common-name-length)) ... ub-common-name-length INTEGER ::= 64 SubjectAlternativeNames has no such restriction, and for DNS names is onl...

#

I don't see anything wrong otherwise. dnssec is fine, caa records are good, it's trying to issue, etc

#

On the overview of your website in the Cloudflare dashboard (the overview tab), on the right side if you scroll down, what is your Acct and Zone id?

radiant badger
radiant badger
radiant badger
#

@lilac copper

lilac copper
lilac copper
radiant badger
radiant badger
#

Here you go, this one got a new cert with no problem

#

@lilac copper

radiant badger
kind gyro
#

When Cloudflare (and others) attempt to request the certificate for you, the first name you have in the certificate will typically be the one used for the Common Name (CN).

#

irb-o00----------6z-6---z--7t6--hr-5l6y-aw5qr----zc--9kk---6o0.shop is 67 characters, and the wildcard *.irb-o00----------6z-6---z--7t6--hr-5l6y-aw5qr----zc--9kk---6o0.shop is 69 characters.

Both of them are therefore long for the Common Name (CN), as Chaika said above.

#

As mentioned in that thread:

In theory, you SHOULD be able to workaround a such limitation, by using another (sub-)domain name that is less than the 64 characters as the Common Name (CN) for your certificate.

For example, it should work just fine when having a Common Name (CN) of example.com, with the following subjectAltName / Subject Alternative Name (SAN) names in the certificate:

example.com
irb-o00----------6z-6---z--7t6--hr-5l6y-aw5qr----zc--9kk---6o0.shop
*.irb-o00----------6z-6---z--7t6--hr-5l6y-aw5qr----zc--9kk---6o0.shop

example.com can literally be anything, as long as it is less than the 64 character limit.

However, a such workaround cannot be made with the free Universal SSL.

On the Business plan, you do have the opportunity to upload your own certificate, which would allow for such a workaround, however, it would also give you the "burden" of having to maintain the certificate on your own and regularly upload a new one to Cloudflare, such as when it gets near to it's expiration.

kind gyro
#

The "Precertificate" from the link above simply does not have any Common Name (CN) attached to it.

radiant badger
kind gyro
#

Do you have any active site on irb-o00----------6z-6---z--7t6--hr-5l6y-aw5qr----zc--9kk---6o0.shop?

#

I.e., any (sub-)domains with A/AAAA record(s)?

radiant badger
#

Only the 2 recent domains I got from the same provider have this issue

radiant badger
radiant badger
kind gyro
kind gyro
radiant badger
kind gyro
#

Go ahead.

radiant badger
#

It says Your message could not be delivered. This is usually because you don't share a server with the recipient or the recipient is only accepting direct messages from friends. You can see the full list of reasons here:

radiant badger
# kind gyro Go ahead.

Btw the irb one has an active panel on one it's subs with proxy on, but most of the traffic is myself, if you want the sub I should send it to you in pv

kind gyro
#

That said, I've opened a DM with you, - can you try again?

radiant badger
#

and I can't send friend request either

kind gyro
#

Discord being Discord, ... I guess...