Why SSL Certificates Can't Be Issued for Domains with Underscores

Last updated: August 19, 2025

This guide explains why Certificate Authorities like Let's Encrypt cannot issue SSL certificates for domains or subdomains containing underscore characters, and how this affects Entri Power and Entri Secure users.

Overview

If you're trying to secure a domain name that contains an underscore character (_), you may have encountered an error when attempting to obtain an SSL certificate through Entri Power or Entri Secure. This isn't a limitation of our services—it's a fundamental restriction imposed by Certificate Authorities, including Let's Encrypt, which serves as Entri's certificate issuer.

Why Underscores Are Not Allowed in SSL Certificates

Internet Standards and RFC Compliance

Certificate Authorities follow strict Internet standards when validating domain names for SSL certificates. The primary standard governing hostname validation is RFC 1123, which defines the valid characters for Internet hostnames.

According to RFC 1123, valid hostnames may only contain:

  • Letters (A-Z, a-z) - case insensitive

  • Numbers (0-9)

  • Hyphens (-) - but not at the beginning or end of a label

Underscores are explicitly prohibited in hostnames under this standard.

Let's Encrypt's Validation Process

Let's Encrypt, Entri's certificate issuer, strictly enforces these hostname validation rules. When you request an SSL certificate, Let's Encrypt validates that the domain name conforms to RFC 1123 standards. If your domain contains an underscore, the validation process will fail with an error similar to:

Error: The request message was malformed :: Invalid character in DNS name

This validation occurs because SSL certificates are specifically designed to secure hostnames that web browsers and other applications can reliably connect to. Since underscores violate hostname standards, they cannot be included in SSL certificates.

Why Some DNS Records Can Use Underscores

You might wonder why you can create DNS records like DKIM, DMARC, TXT, or SRV records with underscores, but not SSL certificates. Here's the key difference:

Hostnames vs. DNS Record Names

  • Hostnames (used for SSL certificates): Must follow RFC 1123 standards and cannot contain underscores

  • DNS Record Names (like TXT, SRV, DKIM, DMARC): Are not hostnames and can contain underscores according to other RFCs

For example:

  • _dmarc.example.com ✅ Valid for DNS TXT records

  • my_subdomain.example.com ❌ Invalid for SSL certificates

  • api-server.example.com ✅ Valid for SSL certificates (uses hyphen instead)

DNS records with underscores serve special purposes like email authentication or service discovery, but they're not intended to be accessed directly by web browsers or applications requiring SSL encryption.

Impact on Entri Products

This limitation affects both:

  • Entri Power/Secure: Cannot provision SSL certificates for domains with underscores

Both products rely on Let's Encrypt as the certificate issuer, which enforces RFC 1123 hostname validation standards.

Important Notes

  • This is not an Entri limitation: All major Certificate Authorities enforce the same RFC 1123 standards

  • Industry-wide standard: The restriction applies to all public SSL certificate providers

  • Security by design: These standards ensure compatibility across all Internet applications and browsers

  • No exceptions: Let's Encrypt does not provide exceptions or workarounds for underscore characters

Need additional help? Contact our support team through the Entri dashboard or visit our help center for more resources.