# How to run certbot instance simultaneously without creating account for each **URL:** \ **Category:** Help\ **Created:** [February 9, 2021, 12:35am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879 "2021-02-09T00:35:37Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 12:35am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/1 "2021-02-09T00:35:37Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: Any domain pointed to our server. I'm generating certificates for each domain inputs in our system. I ran this command: certbot certonly --manual --manual-auth-hook ./authenticator.sh --manual-cleanup-hook ./cleanup.sh --agree-tos --manual-public-ip-logging-ok --config-dir ./.tmp/{hostname}/config --logs-dir ./.tmp/{hostname}/logs --work-dir ./.tmp/{hostname}/work -d {hostname} -m ${email} -n It produced this output: It's working fine but eventually It will hit the "too many registrations for this IP address" limit. My web server is (include version): Nodejs http. I'm using the manual mode. The operating system my web server runs on is (include version): Debian GNU/Linux 10 (buster) My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.31.0 ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 12:47am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/2 "2021-02-09T00:47:35Z")
Welcome to the Let's Encrypt Community, Luis 🙂 I recommend starting here: > **[Integration Guide - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/docs/integration-guide/)** > > Last updated: Aug 8, 2016 | See all Documentation This document contains helpful advice if you are a hosting provider or large website integrating Let’s Encrypt, or you are writing client software for Let’s Encrypt. > Plan for Change Both... ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 12:50am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/3 "2021-02-09T00:50:50Z")
Yeah I've already read that. But how can you actually do this? In ACME, it’s possible to create one account and use it for all authorizations and issuances, or create one account per customer. Do I certbot register then --account to my certbot certonly command? Also I'm running this in a container. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 12:53am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/4 "2021-02-09T00:53:47Z")
Running from within a container is one of the tricky scenarios we're often presented with here. The best way to handle accounts (and certificates) in this type of setup is to create the account(s) up front and import the credentials into the containers. The same applies to certificates for domain names that are being re-used. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 12:55am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/5 "2021-02-09T00:55:36Z")
Doing these things are crucial to keep you from running afoul of the rate limits: > **[Rate Limits - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/docs/rate-limits/)** > > Last updated: Mar 5, 2020 | See all Documentation Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. We believe these rate limits are high enough to work for most people by default. We’ve also designed... ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 12:58am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/6 "2021-02-09T00:58:35Z")
Oh okay but how can i point the created account (let's say main account) when I'm using separate directories for each domain on each issuance? Like these: --config-dir ./.tmp/{hostname}/config --logs-dir ./.tmp/{hostname}/logs --work-dir ./.tmp/{hostname}/work what option do i need to attach to point to the main account? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:07am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/7 "2021-02-09T01:07:04Z")
I don't believe that you do. As long as you're using the same installation of certbot, the same account will be used for all executions. In essence, once you've created an account, strip away all the extra parameters for account creation and management from your command. This: ```nohighlight certbot certonly --manual --manual-auth-hook ./authenticator.sh --manual-cleanup-hook ./cleanup.sh --agree-tos --manual-public-ip-logging-ok --config-dir ./.tmp/{hostname}/config --logs-dir ./.tmp/{hostname}/logs --work-dir ./.tmp/{hostname}/work -d {hostname} -m ${email} -n ``` becomes this: ```nohighlight certbot certonly --manual --manual-auth-hook ./authenticator.sh --manual-cleanup-hook ./cleanup.sh --config-dir ./.tmp/{hostname}/config --logs-dir ./.tmp/{hostname}/logs --work-dir ./.tmp/{hostname}/work -d {hostname} -n ``` You might want a `--preferred-challenges` in there somewhere too. The idea here is just to duplicate the credentials between the folders for each instance. That way you're not creating a new account. Consider it like making photocopies of an ID badge. The Let's Encrypt server doesn't care if you use the same account with 500 instances (as long as you're within the rate limits). > **[User Guide — Certbot 1.11.0.dev0 documentation](https://certbot.eff.org/docs/using.html#id5)** > > Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:10am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/8 "2021-02-09T01:10:44Z")
The global configuration file is really your friend here. You CAN specify your credentials in that file. 😁 This should save you the hassle of duplicating many things. > **[User Guide — Certbot 1.11.0.dev0 documentation](https://certbot.eff.org/docs/using.html#configuration-file)** > > Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates. ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 1:10am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/9 "2021-02-09T01:10:48Z")
This is the Dockerfile ```nohighlight FROM node:14.15.4-buster WORKDIR /srv/node RUN apt update && \ apt install -y curl certbot && \ apt clean RUN certbot register -m email@gmail.com --agree-tos -n COPY ./certs /srv/node/certs COPY ./build /srv/node/build COPY ./package.json /srv/node/package.json COPY ./package-lock.json /srv/node/package-lock.json COPY ./authenticator.sh /srv/node/authenticator.sh COPY ./cleanup.sh /srv/node/cleanup.sh COPY ./certbot-account /srv/node/certbot-account RUN npm install --production && mkdir tokens EXPOSE 80 EXPOSE 443 CMD npm start ``` as you can see the main account will be generated at RUN certbot register -m [email@gmail.com](mailto:email@gmail.com) --agree-tos -n But removing -m actually throws an error 😕. I'll try again thanks for responding. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:13am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/10 "2021-02-09T01:13:47Z")
Did you also remove the email address? ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 1:13am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/11 "2021-02-09T01:13:58Z")
Ohhh that might be the answer 🤩 ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:15am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/12 "2021-02-09T01:15:32Z")
Yeah. Dockerfolk are usually pretty happy with that. It's quite powerful (at creating headaches) so use it wisely. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:16am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/13 "2021-02-09T01:16:09Z")
I've gotta run for now. There are many others around here who could pick this up in the meantime to help. ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 9, 2021, 1:16am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/14 "2021-02-09T01:16:50Z")
Okay thanks griffin. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [February 9, 2021, 1:17am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/15 "2021-02-09T01:17:15Z")
You're quite welcome! 😊 Happy experimenting! ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [February 9, 2021, 1:18am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/16 "2021-02-09T01:18:14Z")
Running multiple instances of Certbot at the same time, against the same configuration directory, is unsafe. Certbot uses a lockfile to prevent this scenario. Some approaches you can use: - Serialize your use of Certbot so that only one copy of it is running at once. Put requests into a queue, and process the queue one at a time. - Run Certbot concurrently, but against different configuration directories (e.g. one per tenant). You could copy the `accounts/` directory so that each instance of Certbot is still technically using the same ACME account. - (My recommendation): don't use Certbot at all if you are doing things programmatically. Find an ACME library for Node.js and obtain certificates using the API. Since you've already written the auth hooks, you've done the hard part. The rest is just some basic function calls. ---
**Author:** ![lafbelmonte](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lafbelmonte/32/47130_2.png) [@lafbelmonte](https://community.letsencrypt.org/u/lafbelmonte)\ **Post date:** [February 10, 2021, 12:13am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/17 "2021-02-10T00:13:45Z")
Someone might have the same approach so I'll share what I did. - Created a main account: certbot register -m [email@gmail.com](mailto:email@gmail.com) --agree-tos -n It will produce the account in /etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/MAIN\_ACCOUNT(its hashed) Now you can freely copy and rename the MAIN\_ACCOUNT anywhere in the host or in another machine. - Copied the MAIN\_ACCOUNT in the root directory of our system/project and renamed it to certbot-account - Then attach `--account /path/to/certbot-account` on our certbot command `certbot certonly --manual --manual-auth-hook ./authenticator.sh --manual-cleanup-hook ./cleanup.sh --agree-tos --manual-public-ip-logging-ok --config-dir ./.tmp/{hostname}/config --logs-dir ./.tmp/{hostname}/logs --work-dir ./.tmp/{hostname}/work -d {hostname} -m --account /path/to/certbot-account -n ` This time it will not create a new account because you are pointing it to the certbot-account. Note: I'm using certbot 0.40.0 --account /path/to/account may not work on lower versions because it doesn't recognize the path and you will encounter Account IDS mismatch. IDK 🤔 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 12, 2021, 12:14am UTC](https://community.letsencrypt.org/t/how-to-run-certbot-instance-simultaneously-without-creating-account-for-each/144879/18 "2021-03-12T00:14:07Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.