General questions about limits by IP

Help
1

Hello,

I have some questions about limits. I read the documentation about rate limits request so no problem with that and I didn't find another topic with these questions.

I want to know if there is some limits to certificate delivery for the same public IP ?
I have heard something about a maximum of 500 certificates for the same public IP, is it true ?

If there are for exemple 800 differents domains, is it possible to request 800 certificats from the same public IP / web server ?

Another question, do you think is it possible to store / host 500 certificates on the same virtual machine (with Nginx Proxy Manager for example) or there is a limit or difference between physical server and VM for Let's encrypt certificates and the SSL connection management ?

With enough vCPU and RAM, do you think a VM can handle the same number of certificates / SSL connections than a physical server ?

Thank you for you help.

1 Like
2

No, the only rate limit with regard to IP address (range) is the " New Registrations" rate limit.

No other rate limit applies to IP addresses.

I don't have an opinion about the other questions.

3 Likes
3

There is (was?) a rate limit on requests from an IP on the CDN side of things, but it's not documented. I speculate it's on the order of thousands of requests per second.

4 Likes
4

There are three relevant bottlenecks here:

Obtaining the Certificate

Some ACME clients perform poorly at scale. Certbot is historically miserable with large Nginx deployments; the performance degrades substantially as the number of clients increases. This is largely due to how it parses and manages the config files; performance returns to normal if you switch to the webroot or standalone plugins.

Loading large numbers of Certificates

"Certificates" have two components: The actual Certificate and the Private Key. Depending on your server and how it manages memory/certs, you may be able to optimize memory by recycling the same Private Key across multiple certificates. You can't do this if there are multiple domain owners, and they have access to the Private Keys (it violates the Subscriber Agreement to expose the keys to different entities), but if you have sole access to the Private Key this is allowed. For large installations, I recycle the same Private Key on a periodic basis (i.e. all certs within one week use the same key).

There are many projects that support dynamic loading of SSL Certificates. I opensourced ours a while back, but have not ported updates back. You can use it for inspiration if needed - GitHub - aptise/peter_sslers: or how i stopped worrying and learned to love the ssl certificate is the backend and GitHub - aptise/lua-resty-peter_sslers: OpenResty/Lua support for https://github.com/aptise/peter_sslers Certificate Manager is the OpenResty (nginx fork) plugin. In my design, I use a multiple tiered cache to load certificate data on demand:

  • nginx worker memory
  • nginx shared memory
  • redis
  • python backend

Handling Multiple Connections

This depends on the server's concurrency limits, how the server stores certificate data in memory, and how certificates are loaded.

5 Likes
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.