I already opened an issue on the Github page of the Public Suffix List Project( link ) but i'm not sure if it's the correct place for this to be handled. Copy of the issue text: The letsencrypt project is using the public suffix list while checking for accidental and intentional abuse. The resul…

I agree that for many use cases, rate limits should be increased for some domain, but that domain isn’t necessarily a public suffix as such. We’re definitely trying to figure out better ways to divide up rate limits in a way that makes sense, and reduces excess burden on the PSL maintainers. Note th…

[image] tlussnig: As already said it is impractical because it require an central managed _bound for each TLD Basically you just need a wildcard record, i.e. *._bound.com, unless you need a more specific rule for some labels. Any rollout of DBOUND would probably require a period where client…

[quote=“jsha, post:23, topic:7629, full:true”]possibly more than can reasonably be handled in a static list. [/quote] And that’s why a static list is a dumb idea. Either you only care about official ICANN suffixes or you start to automate the process. The current approach is IMHO half-assed. Every…

OK, I see. So the bottleneck is signing OCSP responses? I wonder how other CAs deal with this problem. Many CAs have a lot more issued certificates than LE do (at the moment). I guess they simply have to use a high-performance HKM - replicating the signing keys would be a no-no. I have never come …

@jackc the other CAs does not have to deal with this issue. StartSSL: you can only issue one cert per domain and 11,5 months.for free WoSign: up to 3 SAN entries per domain and 23,5 months for free All others fetch money, so there is no problem that the people issue certificates long before they …

[image] jsha: The limiting factor in this case is signing capacity for OCSP responses, which we sign for each extant certificate every three days So why don't you use one or two separate keys just for OCSP signing?

[image] autoit4you: So why don't you use one or two separate keys just for OCSP signing? The keys for OCSP signing still need to be kept in an HSM, so this doesn't eliminate our bottlenecks.

@jsha but the bottleneck gets larger.

[image] jsha: The keys for OCSP signing still need to be kept in an HSM, so this doesn't eliminate our bottlenecks. But wouldn't a separate HSM for the OSCP key double the theoretical signing capacity of the current situation? Although, now that I think about it, I also assume that OCSP signi…

can an HSM save multiple keys? maybe you can let x1 and x2 do some OCSP work while they are not busy…

Exempt FreeDNS domains from the rate limit

Issuance Policy

tlussnig January 18, 2016, 6:29pm 37

Hi @My1 with OCSP signing each 3 Day the ratio would be 1:30.

Topic		Replies	Views
Too many certificates already issued - rate limit? Issuance Tech	41	19617	January 13, 2017
Certificates/Domain Limit Problem Issuance Policy	22	6571	June 23, 2016
New rate limit question	22	8824	April 19, 2016
Ratelimit for dyndns domain	38	19035	May 25, 2016
Let's Encrypt rate limits and alternative solutions Help	33	6658	August 12, 2020

Exempt FreeDNS domains from the rate limit

Related topics