Effect on rate limits when obtaining dual RSA and ECC certificates

With the way Let's Encrypt is currently handling this, you wouldn't be able to create two authorizations at the same time for the same hostname, using the same ACME account. If you attempt to create another authorization, boulder will silently return the first authorization with a status of "valid". You could save a couple of round-trips to the ACME server by just issuing two new-cert requests after doing the whole POST new-authz > POST challenge > GET authz dance instead of issuing the two certificates independently, but that's probably not all that important.

Yep, there's no special case for RSA/ECC or anything like that. An identical (duplicate) certificate is simply defined as one where the hostnames match exactly. The public key (or its type) doesn't matter - five certificates with different keys, all valid for www.example.com, example.com would still be considered duplicates. Another way to put it: You can mess up once, but if you lose your private keys again, you'll only be able to get one more certificate (i.e. just one key type). There'd still be the option to work around the duplicate certificate rate limit by adding another subdomain, though IIRC Caddy doesn't do SAN certificates, so that might not be a workaround you could suggest for users running into a problem with this.

The "Certificates per Registered Domain (20 per week)" limit would be affected by this just as much, though of course there's an exemption for renewals, so you'd at least not lose the ability to renew certificates, short of running into the identical/duplicate cert limits.

3 Likes