# Can ARI-conforming clients be granted exemptions to relevant rate limits? **URL:** https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 **Category:** Client dev **Created:** [March 31, 2023, 6:22pm UTC](https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 "2023-03-31T18:22:09Z") **Posts on this page:** 1 **Showing post:** 32
### Author: ![mholt](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mholt/32/70171_2.png) [@mholt](https://community.letsencrypt.org/u/mholt) #### Post date: [March 31, 2023, 11:28pm UTC](https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600/32 "2023-03-31T23:28:01Z")
> [@Osiris](#): > > What's the purpose of the "MUST" in the (draft) RFC if it's optional? Right, it wouldn't say "MUST". I'm quite sure "optional" is not what the RFC editors meant. Exact wording: > Conforming clients MUST attempt renewal at a time of their choosing > based on the suggested renewal window. So, fair enough. I will choose a time based on the suggested window as it states I "MUST" do. Not necessarily within, since I cannot be guaranteed to get the cert within that window. But the spec does not say within. > [@orangepizza](#): > > (thinks windows is too small to fit all the certificates he started), but still want to watch ARI to look out impending revocation event Exactly. As-is, ARI seems to be a great early renewal canary, so I will use it as such; but the precise window will be untenable for large deployments unless the CA is willing to guarantee I can get the cert _within_ that window. * * * I'll try to spell this out as crystal-clear as I can. Try to keep up: - Large deployments may have more certificates to renew per day than LE rate limits will allow (I mean any/all rate limits combined, but I will yet _again_ emphasize the "New Orders" rate limit since I mentioned it on my very first post but some readers clearly did not see that). And yes we have real, actual production experience with this. None of this "theoretical" stuff mentioned above by those who admit they do not have experience with it. - Current behavior is to spread out renewals over more time so that we can renew all of them before they expire. This means starting some earlier than 30 days out. - Implementing ARI implies a narrower window in which to renew certificates, ironically in an effort to spread out the load more. 🤷‍♂️ This is problematic for a few reasons: - The ARI spec recommends an algorithm that renews within the window, but CA policies such as rate limits can prevent certs from being renewed in that window. Fortunately, the spec's language states that renewal scheduling decisions "MUST" at least be "based on" the "suggested" window. Since we cannot be assured a new cert within that window, we can at least use ARI as an early warning signal for upcoming or predicted problems: revocation, availability, maintenance, etc. Now, let's try to figure out a best course of action based on possible window changes for a hypothetical certificate we just obtained: Having large-scale production experience with lots of certs and LE rate limits, the thing that makes the most sense for me to do with ARI is to use it as an early warning signal. If the window changes, there is clearly some doubt as to system availability or certificate validity. Thus start trying to renew the cert right away so the graceful backoff has as much chance to procure a certificate before expiration (or revocation ❗ ) This way if we hit rate limits, it will backoff and try again later, without running out of time because we started early enough. Now... if this part I said: > Since we cannot be assured a new cert within that window could be changed -- i.e. if we COULD in fact be assured a cert within that window -- then everything gets better. If that window basically meant, "You can for sure have the cert anytime within this window. (But just once.)" then I would absolutely have no problem renewing all certificates precisely within that window. This means the client must be assured that no rate limits would block them from getting a cert within the window. If we cannot be assured that, we have to do our best to get a cert on our own, which means starting renewals earlier. Hence, if we want ARI to be useful, I am requesting a rate limit exemption for clients adhering to the ARI window. --- _[View the full topic](https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600)._