Facing the limit on cert update going for 2 weeks now.
We use automatic routine to renew expiring certs daily using http-base domain validation. For one of the certs the process has been failing repeatedly for over a week, validation failure of one of SAN domains due to dns misconfiguration(not pointing to the right http server any longer). That triggered throttling on LE side:
{
"type": "urn:ietf:params:acme:error:rateLimited",
"detail": "Error creating new order :: too many certificates already issued for: schibsted.io: see Rate Limits - Let's Encrypt",
"status": 429
}
Limits ocumentation states that:
- "Exceeding the Duplicate Certificate limit is reported with the error message too many certificates already issued for exact set of domains."
However, the request still bounces immediately when I alter SAN domain list : removing one domain from SubjAltName and adding another. This is unexpected since doc says "already issued for exact set of domains". Key word is "exact". Technically since I changed SAN domain list in request it's supposed to be treated as new request.
Can someone elaborate on it? Is the doc inaccurate or am I misreading it?
- "We use a sliding window, so if you issued 25 certificates on Monday and 25 more
certificates on Friday, you’ll be able to issue again starting Monday."
Seemingly the failed requests still count toward max threshold. I.e. even though the actual cert is never issued each attempt counts toward "5 per week".
The question is - do immediately bounced requests count toward max limit as well or not?
The reason asking is that it's unclear what is the true "wait" time until I can re-issue cert request without being bounced/limited.
Other details:
certbot version: 0.36.0
actual request:
[DEBUG] 2022-10-06T14:13:29.118Z 3d467498-77ca-4370-8fb6-80d3f78a9160 Arguments: ['certonly', '-n', '--agree-tos', '--email', 'xxx@myorg.com', '--server', 'https://acme-v02.api.letsencrypt.org/directory', '--manual', '--manual-public-ip-logging-ok', '--preferred-challenges', 'http', '--manual-auth-hook', '/var/task/auth-http.sh', '--manual-cleanup-hook', '/var/task/cleanup-http.sh', '-d', 'cmp.aftenbladet.no', '-d', 'cmp.aftenposten.no', '-d', 'cmp.aftonbladet.se', '-d', 'cmp.av-avis.no', '-d', 'cmp.avointyopaikka.fi', '-d', 'cmp.bareasane.no', '-d', 'cmp.bt.no', '-d', 'cmp.byas.no', '-d', 'cmp.bygdanytt.no', '-d', 'cmp.dinepenger.no', '-d', 'cmp.e24.no', '-d', 'cmp.finn.no', '-d', 'cmp.friflyt.no', '-d', 'cmp.friflytbestill.no', '-d', 'cmp.godare.se', '-d', 'cmp.godt.no', '-d', 'cmp.helthjem.no', '-d', 'cmp.honkhonk.dk', '-d', 'cmp.honkhonk.fi', '-d', 'cmp.honkhonk.no', '-d', 'cmp.honkhonk.se', '-d', 'cmp.jeger.no', '-d', 'cmp.kesaduuni.org', '-d', 'cmp.klart.se', '-d', 'cmp.klarttest.net', '-d', 'cmp.landevei.no', '-d', 'cmp.ledenicheur.fr', '-d', 'cmp.letsdeal.no', '-d', 'cmp.letsdeal.se', '-d', 'cmp.minmote.no', '-d', 'cmp.norsk-klatring.no', '-d', 'cmp.oikotie.fi', '-d', 'cmp.omakotimessut.net', '-d', 'cmp.omataloyhtio.fi', '-d', 'cmp.omni.se', '-d', 'cmp.omniekonomi.se', '-d', 'cmp.oyposten.no', '-d', 'cmp.peil.no', '-d', 'cmp.pent.no', '-d', 'cmp.podme.com', '-d', 'cmp.pricespy.co.uk', '-d', 'cmp.prisjakt.no', '-d', 'cmp.prisjakt.nu', '-d', 'cmp.privacy-dev.schibsted.io', '-d', 'cmp.privacy-pre.schibsted.io', '-d', 'cmp.privacy-pro.schibsted.io', '-d', 'cmp.puutarha.net', '-d', 'cmp.qasa.fi', '-d', 'cmp.rakentaja.fi', '-d', 'cmp.rakentaja.pro', '-d', 'cmp.randaberg24.no', '-d', 'cmp.rrmessut.fi', '-d', 'cmp.sahkovertailu.fi', '-d', 'cmp.strilen.no', '-d', 'cmp.svd.se', '-d', 'cmp.talovertailu.fi', '-d', 'cmp.tek.no', '-d', 'cmp.terrengsykkel.no', '-d', 'cmp.tori.fi', '-d', 'cmp.tv.nu', '-d', 'cmp.utemagasinet.no', '-d', 'cmp.vestnytt.no', '-d', 'cmp.vg.no', '-d', 'cmp.vgd.no', '-d', 'cmp.vglive.no', '-d', 'cmp.vgnett.no', '-d', 'cmp.vgtv.no', '-d', 'cmp.wellness.se', '-d', 'psi-dev.svd.se', '-d', 'psi.svd.se', '-d', 'samtykke.bilbasen.dk', '-d', 'samtykke.dba.dk', '-d', 'cmp.honk.no', '--config-dir', '/tmp/config-dir/', '--work-dir', '/tmp/work-dir/', '--logs-dir', '/tmp/logs-dir/']
Any help is much appreciated as the cert is about to expire in few days and we're stuck with hitting the limit.
