Resolving ACME errors when issuing an SSL certificate

When you switch on HTTPS for a virtual host, the BeAdmin control panel requests an SSL certificate from Let's Encrypt and adds it to the Nginx configuration. The request uses ACME — the public standard for automated certificate issuance.

To issue the certificate, Let's Encrypt has to confirm that you actually own the domain. Let's Encrypt sends a validation request to the domain from the public side — if DNS, Nginx, or the network ports are misconfigured, validation fails and the panel reports an error.

Enabling HTTPS

HTTPS is switched on with the «Use HTTPS (port 443)» toggle when you create or edit a virtual host — the panel requests the certificate right away. For details on the virtual host form, see Nginx. Working with virtual hosts; for how issuance is wired up and how to reissue manually, see Issuing an SSL certificate. This article is a reference for specific error messages.

If the certificate cannot be issued, the panel shows an error notification. Under the ACME error: heading it contains the original error text from the certificate authority — look there for details rather than in the server logs. Specific messages and what to do about them are listed below.

Error messages

Below are the messages the panel shows when issuance fails: what happened on the Let's Encrypt side and what to fix. If your message is not listed here, see Other Let's Encrypt error.

No DNS records for the domain

Failed to issue SSL certificate: DNS records for the domain not found.

Let's Encrypt did not find any DNS records for the domain name — either the domain is not delegated to your provider's DNS servers, or no records have been added yet.

What to do:

1. Make sure the domain is delegated to the DNS servers of your registrar or provider.
2. Create an A or AAAA record pointing to the server's IP address. For details on configuring DNS, see Configure DNS records for the mail server (the section on the A record applies to any website).
3. Wait for the changes to propagate (usually a few minutes, sometimes up to an hour) and try issuing the certificate again.

Missing A or AAAA record

Failed to issue SSL certificate: A or AAAA DNS records for the domain not found.

The domain has some DNS records (for example, MX or TXT), but no A (IPv4) or AAAA (IPv6) record. Without them Let's Encrypt does not know which IP to reach the server at.

What to do:

1. Add an A record with your server's IP address, or an AAAA record if you use IPv6.
2. Wait for propagation and retry the issuance.

DNS pointing to another server

Failed to issue SSL certificate: DNS records point to another server.

An A or AAAA record exists, but it points to a server other than the one running BeAdmin. The Let's Encrypt request reached a different IP, and the ownership check failed.

What to do:

1. Compare the server IP shown in the panel with the domain's A record.
2. Correct the A record at your registrar or DNS provider. If the record is correct but was added recently, wait for propagation.
3. If you use a proxy (for example, Cloudflare), disable proxying for the duration of the issuance — in Cloudflare, switch the cloud from orange to grey.

This same message can appear if the site intercepts the service address /.well-known/acme-challenge/ — for example, through WordPress, a CMS router, or a catch-all / location. In that case the A record may be correct.

If the A record points to your server:

1. Make sure the virtual host was created in BeAdmin through the standard form — the panel adds the required ACME location automatically.
2. If you added custom rules to the Nginx config, make sure they do not block /.well-known/acme-challenge/.
3. Disable any CMS security plugins that intercept unknown URLs.

Redirect loop during validation

Failed to issue SSL certificate: redirect loop when verifying domain ownership.

The server replies to Let's Encrypt with a chain of redirects that loops. Most often this happens when Nginx redirects HTTP to HTTPS but no HTTPS certificate exists yet — Let's Encrypt cannot complete the check over http://.

What to do:

1. Temporarily remove the forced HTTP-to-HTTPS redirect on the site or CMS side.
2. Wait for the certificate to be issued, then put the redirect back.
3. If the redirect comes from a CDN or external proxy, disable it during issuance.

Let's Encrypt rate limit exceeded

Too many SSL certificate requests.

Too many SSL certificate requests, next attempt available in {diff} ({human}).

Let's Encrypt limits the number of requests per IP address, not per domain, so the limit can also be used up by other servers with the same external address.

If the limit is reached or Let's Encrypt has an outage, the panel automatically retries the issuance through another certificate authority. You will see the error if the issuance failed there as well.

What to do:

1. Wait for the limit to reset. If a specific time is shown in the message, follow it; otherwise wait up to 3 hours.
2. Before retrying, make sure DNS, port 80, and redirects are configured correctly — otherwise the issuance will fail again.
3. If the site needs HTTPS urgently, switch it to HTTP while you wait.

Other Let's Encrypt error

Failed to issue SSL certificate due to Let's Encrypt error.

The generic message does not explain the cause — the original error text in the notification under the ACME error: heading does. Use it to decide what to fix. Typical cases:

• Port 80 closed or busy — the text contains Timeout during connect or Connection refused. Let's Encrypt validates the domain with a request to port 80 of your server: if the port is blocked by a firewall, occupied by another process, or redirected, validation fails. Open port 80 in the server firewall and at the hosting provider, and free it if another service holds it — Nginx must listen on that port.
• Validation timeout — the text contains Timeout after connect. The server did not respond to Let's Encrypt in time — for example, because of overload or network problems. Wait a few minutes and retry the issuance; check whether the server responds over HTTP from another machine — for example, with curl http://yourdomain.com/.well-known/acme-challenge/test. If the problem persists, contact your hosting provider.
• CAA record blocking — the text contains CAA record for yourdomain.com prevents issuance. The domain's CAA record does not allow issuance through Let's Encrypt. Check the records — for example, with dig +short CAA yourdomain.com — and add a record with letsencrypt.org, or remove the restricting ones if you do not need them. Wait for propagation and retry the issuance.

If the text says something else:

1. Compare the message with the current Let's Encrypt status — sometimes the failure is caused by the certificate authority being unavailable rather than by your server.
2. If you cannot work it out, contact support and attach the text from the notification.

See also

• Nginx. Working with virtual hosts
• Issuing an SSL certificate
• Configure DNS records for the mail server
• Let's Encrypt rate-limits documentation
• ACME protocol documentation (RFC 8555)