Search... ⌘ K
Get Started Contact Sales

Troubleshooting Let’s Encrypt Certificate Failures

Last updated

Table of Contents

Let’s Encrypt certificates in DNSimple use DNS-based validation. The domain must resolve with DNSimple’s name servers for the ACME challenge to succeed. If your certificate is not issuing or renewing, check the following.

Domain Not Resolving With DNSimple

Let’s Encrypt certificates require the domain to be delegated to and resolving with DNSimple’s name servers. If the domain’s name servers have been changed to another provider, the DNS challenge will fail, and ordering or renewing the certificate shows the error The zone example.com does not resolve with DNSimple.

Check: Go to the domain page in DNSimple and verify the name server delegation status. The domain must be using DNSimple’s name servers.

Fix: If the domain was moved to another DNS provider, update the name servers back to DNSimple, or switch to a Sectigo certificate which does not require DNSimple DNS.

Secondary DNS Conflict

Let’s Encrypt certificates are not compatible with Secondary DNS. The domain must be delegated only to DNSimple’s name servers, and with Secondary DNS the delegation includes another provider’s name servers, so DNSimple cannot complete the validation.

Fix: Either disable Secondary DNS for the domain or use a Sectigo certificate instead.

CAA Records Blocking Issuance

If your domain has CAA records and Let’s Encrypt is not listed as an authorized CA, the certificate request will be denied.

Fix: Add a CAA record authorizing Let’s Encrypt: example.com. CAA 0 issue "letsencrypt.org". For wildcard SSL certificates, also add: example.com. CAA 0 issuewild "letsencrypt.org".

If you do not have any CAA records, this is not an issue, because any CA can issue when no CAA records are present.

Existing CNAME Record on _acme-challenge

To validate a Let’s Encrypt certificate, DNSimple adds a TXT record named _acme-challenge for each name on the certificate. A TXT record and a CNAME record cannot exist at the same name, so if a CNAME is already there, DNSimple cannot add the TXT record. The certificate is cancelled, and DNSimple emails you that it cannot be issued. The email includes Please remove the conflicting CNAME record.

Some services, such as CDNs, ask you to add a CNAME on _acme-challenge so they can validate the domain for their own certificates. If you stopped using the service, the CNAME may still be in your zone.

Check: In the record editor, look for a CNAME record whose name starts with _acme-challenge. A certificate for app.example.com uses _acme-challenge.app.example.com, and a wildcard certificate for *.example.com uses _acme-challenge.example.com. A certificate for www also covers the root domain, so check both _acme-challenge.www.example.com and _acme-challenge.example.com.

Fix: Confirm no other service still needs the CNAME, then delete it. If another provider still uses it to validate its own certificates, removing it stops that validation. Then order a new Let’s Encrypt certificate, or renew the certificate manually if the failure happened during a renewal.

DNSSEC Misconfiguration

If DNSSEC is enabled for the domain but is misconfigured (for example, stale DS records at the registrar after a DNS provider change), the CA cannot securely resolve the ACME challenge record and validation will fail.

Check: Use an online DNSSEC validator (such as DNSViz) to check for DNSSEC errors on your domain.

Fix: Either fix the DNSSEC configuration (update DS records at the registrar to match the current DNSKEY records) or disable DNSSEC if it is not required.

Let’s Encrypt Rate Limits

Let’s Encrypt enforces rate limits on certificate issuance. The most relevant limits are:

  • 50 certificates per registered domain every 7 days. This includes all subdomains. If you manage many subdomains under one domain, you may hit this limit.
  • 5 certificates for the same exact set of names every 7 days. If you request the same names multiple times, you may be rate-limited.

Fix: Wait for the limit to refill. Let’s Encrypt restores capacity gradually rather than all at once after a week. If you are consistently hitting limits, consider consolidating names into fewer Subject Alternative Name (SAN) certificates.

Empty Non-Terminal (ENT) Issues

ACME challenge records (e.g., _acme-challenge.subdomain.example.com) may create Empty Non-Terminals (ENTs) in your DNS zone. If you use wildcard DNS records, ENTs can affect resolution for intermediate domain names.

Learn more: Wildcards and ENTs

Auto-Renewal Failures

If auto-renewal is enabled but the certificate is not renewing, the most common causes are the issues listed above: delegation changes, DNSSEC problems, CAA records, a CNAME on _acme-challenge, or rate limits. DNSimple does not retry a failed auto-renewal, and it emails you when one fails. Fix the underlying issue, then renew the certificate manually and turn auto-renewal back on.

If the certificate has already expired, you will need to order a new Let’s Encrypt certificate.

Have more questions?

If you have any questions about Let’s Encrypt certificate issues, contact support, and we’ll be happy to help. You can also read more about SSL certificates at DNSimple.