Am I getting account-level rate-limited?

Help
1

We run a hosting service that uses LE to generate certificates.
From time to time, we produce spikes of certificate requests for misconfigured domains (which will fail to generate).

We're concerned that these spikes could be preventing us from issuing certificates for properly set up domains.
The only logs we can see are

Your account is temporarily prevented from requesting certificates for <domain> and possibly others.

Is this log also used when completely rate-limiting the account?
If not, than what log should I be looking for in such cases, so I can properly alert on it?

Thank you!

2

I think this is what's going on:

2 Likes
3

My understanding is that the pausing of zombie clients is hostname-specific, so it shouldn't stop certificates for properly-set-up domains even if the ACME account is failing on other names.

5 Likes
4

Yes, we deliberately didn’t pause at the account level to avoid breaking shared hosts in cases like this.

I would recommend you consider some preflight validation to make sure domains are configured properly before trying to issue.

7 Likes
5

To be clear: that error message is the error message we provide when an account-hostname pair has been paused. Your repeated failures to validate certain domains are resulting in any subsequent orders for those domains being rejected. The error message is much longer than the one sentence you pasted here, and should contain a link with all the information you need.

7 Likes