Could not issue a Let’s Encrypt certificate: DNS zone contains an AAAA record, but the domain is not assigned an IPv6 address in Plesk

Symptoms

• Unable to issue a Let’s Encrypt certificate for a domain or Plesk, the process fails with the following error message:

  PLESK_ERROR: Error: Could not issue a Let’s Encrypt SSL/TLS certificate for example.com
  The example.com DNS zone contains an AAAA record, but the domain is not assigned an IPv6 address in Plesk.
  To resolve the issue, either assign an IPv6 address to example.com (“Websites & Domains” > “Web Hosting Access”) or remove the AAAA record from the example.com DNS zone.
  See the related Knowledge Base article for details.
  Details
  Invalid response from https://acme-v01.api.letsencrypt.org/acme/authz/qxK-vAPtGYg3YOSEcgZNB7HBd-unn4oX3GLtZWSxVPA.
  Details:
  Type: urn:acme:error:unauthorized
  Status: 403

• Domain or Plesk resolves to an IPv6 address:

  # dig @8.8.8.8 +short -t AAAA example.com
  2001:db8:f61:a1ff:0:0:0:80

Cause

Domain or Plesk resolves to an IPv6 address but the domain is not assigned or does not have an IPv6 in Plesk.

Resolution

There are two different solutions available, consider one of the following options:

• Remove AAAA record from the domain/Plesk DNS zone,

• If the issue is with a domain assign an IPv6:

  1. Log in to Plesk GUI

  2. Go to Domains > example.com > Web Hosting Access and assign an IPv6 to the domain.

• If the issue is with Plesk add an IPv6:

  • Log in to Plesk GUI

  • Go to Tools & Settings > IP Addresses and add an IPv6.