Facing the limit on cert update going for 2 weeks now. We use automatic routine to renew expiring certs daily using http-base domain validation. For one of the certs the process has been failing repeatedly for over a week, validation failure of one of SAN domains due to dns misconfiguration(not poi…

I confirm the problem is due to excessive numbers of certs for the apex domain schibsted.io There have been problems viewing the public Certificate Transparency logs today but I just got a good retrieval. The rate limit described above is 50 such certs per week. I did not count them all but there…

Hello @sergeisp , welcome to the Let's Encrypt community. :slightly_smiling_face: The first thing I noticed is [image] sergeisp: certbot version: 0.36.0 which is very old, I suggest updating Certbot. What version of OpenSSL do you use? Also double check you are not using less than TLS v1.2…

[image] sergeisp: "type": "urn:ietf:params:acme:error:rateLimited", "detail": "Error creating new order :: too many certificates already issued for: schibsted.io : see Rate Limits - Let's Encrypt ", "status": 429 You are correct about the rate limit of 5 / week for exact same set of names. B…

[image] sergeisp: Limits ocumentation states that: "Exceeding the Duplicate Certificate limit is reported with the error message too many certificates already issued for exact set of domains." That's not the correct rate limit you're looking at. This one is for the entire domain, i.e., 50 c…

Does that mean that if I have 3 subdomains for one domain in the cert request and it ran once a day for a week I effectively exhausted 3*7=21 "certs", plus any manual cert requests would contribute another 3 on top?

Last time a cert for that domain (set of domains) was sucessfuly generated back I Jul. None since then.

[image] sergeisp: and it ran once a day Are you getting new certs daily?

No. I have automation which would try to renew the cert with expiration <30d. It will keep retrying daily. Attempts to renew that particular cert failed due to failure to validate one of the SAN domains. I always though only successful cert requests contribute to the limit threshold, apparently no…

[image] sergeisp: I always though only successful cert requests contribute to the limit threshold, apparently not the case. Depends on the rate limit. Yes, only issued certs contribute to the duplicate certs rate limit and certs per domain rate limit, but e.g. the Failed Validation rate limit…

[image] sergeisp: certbot version: 0.36.0 FYI - Certbot 1.31.0 Release

Thank you Mike! This finally makes sense now. Much appreciated!

Cert request throttling

Help

Bruce5051 October 6, 2022, 7:26pm 11

FYI - Certbot 1.31.0 Release

Topic		Replies	Views
Understanding certificate limits Issuance Policy	12	3232	December 19, 2020
Too many certificates already issued for exact set of domains Help	2	7135	January 13, 2020
Rate limit of 50 certs per week being flagged by renewal attempts? Help	6	762	March 7, 2023
Reach rate-limits Help	4	532	November 18, 2019
Both issuing and renewing certificates fails Help	14	889	September 25, 2021

Cert request throttling

Related topics