Disabled/Enabled Universal SSL multiple times, waiting from minutes to 24 hours.
removed the domain from current account and added it to a new accoount, etc.
Universal SSL works fine for another domain within the same account.
Was the site working with SSL prior to adding it to Cloudflare?
I noticed your post hasn’t received any replies yet, and I wanted to check in on you. Sometimes, posts can slip through the cracks in busy forums, but your concerns are important to the community.
Are you still experiencing the issue? If so, could you provide any additional details or updates since your original post? This information can help the community better understand your situation and offer more targeted advice or solutions.
If you’ve already found a solution, it would be great if you could share it here. Not only does it help others who might be in a similar situation, but it also enriches the knowledge base of our community.
Looking forward to your update, and hoping we can help resolve your issue together!
I found some other messages here where people report same problem with spb.ru subdomains.
It looks like Google Trust refuses to issue certificates for spb.ru subdomains
I have no problem with my epi.ru domain so it’s probably not related to the .ru zone (sanctions etc)
spb.ru is a regional geographic subdomain of the .ru zone
Same problem on ipschool.spb.ru, opencity.spb.ru, artera.spb.ru, graft.spb.ru, and vvs .spb.ru.
The Edge certificate issued by Google Trust Services just expired and no renewal is issued.
These domains are using Universal SSL for years, everything was just fine, no configuration changes.
It seems like Google Trust Services banned *.spb.ru specifically (for the reason unknown). I have few sites in *.pp.ru, *.org.ru, *.net.ru, and in *.msk.ru. Google Trust Services works fine for them, certificates have been updated successfully just few days ago.
If you try and request a certificate from Google trust services directly we get this issue in the certbot logs:
acme.messages.Error: urn:ietf:params:acme:error:rejectedIdentifier :: The server will not issue certificates for the identifier :: Problem(s) occurred while validating identifiers within the new-order request, see the subproblems field for specifics.
Problem for ipschool.spb.ru: urn:ietf:params:acme:error:rejectedIdentifier :: The server will not issue certificates for the identifier :: These domain names are listed as protected: spb.ru due to Specially Designated Nationals (SDN) sanctions, Office of Foreign Assets Control, Dept. of Treasury, US
2025-05-16 10:23:35,988:ERROR:certbot._internal.log:An unexpected error occurred:
2025-05-16 10:23:35,989:ERROR:certbot._internal.log:Problem(s) occurred while validating identifiers within the new-order request, see the subproblems field for specifics.
The domain spb.ru is associated with entities that have been sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). Specifically, the SPB Exchange (Public Joint Stock Company SPB Exchange) was added to the Specially Designated Nationals (SDN) list on November 2, 2023, under Executive Order 14024, which targets entities operating in sectors of the Russian economy supporting its military-industrial base.
It seems like the Lets encrypt and still issuing certs for these domains.
thanks for your time ( haven’t got mine to install GTS )
looks crazy inconsistently. spb.ru is just a geographic subdomain, and not even very popular in Russia. If they block on a geographic basis, then why not the entire RU zone?? There are much more companies from the SDN list there…
Any case, sanctioned entities have much more opportunities, including without Cloudflare. So, as a result, mainly hobby projects and small businesses suffer…
