Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com ), so withholding your domain name here does not increase secr…

Looking at our logs and rate limit config, you do have a rate limit override in place for “ Certificates per Registered Domain .” However, you don’t current have a rate limit in place for “ New Orders ” (300 per account per 3 hours). The New Orders rate limit is new in ACMEv2 and may be newly hitting yo…

https://tools.letsdebug.net/cert-search?m=domain&q=shupp-ratelimit-3182020.vinztest.com&d=744 [immagine]

The search there assumes you don’t have any rate limit exemption, which OP does. Something is a little weird though, check this out: If I try create a certificate for xxx-not-real.vinztest.com: >There were too many requests of a given type :: Error creating new order :: too many certificates alre…

I assumed without exemption it would have triggered 429s a lot earlier than 173. [image] _az: ~~>There were too many requests of a given type :: Error creating new order :: too many certificates already issued for: vinztest.com : see https://letsencrypt.org/docs/rate-limits/~~ this error mess…

Thanks @_az for the response. @lestaff , could you confirm our increased rate limit is still in place? Again, the acme email being used is umbrella-auto-ssl-certs@cisco.com . Thank you!

@9peppe thanks for the response and info. This does not reflect our rate limit increase.

@jsha thanks very much for the prompt response. I have just filled out the form, please let me know if you have any questions or concerns. We are currently unable to create new certificates, which is more impactful than renewal rate limiting. If you are able to expedite the increase, that would …

[image] wshupp: We are currently unable to create new certificates, which is more impactful than renewal rate limiting. The rate limits are rolling, and that one is only over a time period of 3 hours. You shouldn't be totally unable to issue certificates for long.

The adjustment is now live. Let me know if you have any more problems. By the way, welcome to the forum!

@mnordhoff you are correct, after that post we did see some go through, though some were still getting limited. Incidentally, we scheduled renewals of about half of our certificates after the announcement of impending revocations a couple of weeks ago due the CAA security bug incident. What we did…

Help with rate limiting

Help

Topic		Replies	Views
Failed to create Order Help	4	3096	April 28, 2020
Failed to create Order: 429 Help	11	2102	March 6, 2023
Not understanding which rate limit is being hit Help	4	2036	December 17, 2016
Can't figure out why we are hitting a rate limit Help	7	1893	October 18, 2021
Too many certificates already issued for exact set of domains Help	5	1802	November 17, 2019

Help with rate limiting

Related topics