HTTP 429 rate limit persists for over 2 months despite single-domain certificate requests

[evan.huang]

My domain is:
git.owgps.net

I ran this command:
Certificate request initiated via Nginx UI using lego (DNS-01 solver configured).

It produced this output:
2026/01/12 14:16:34 [INFO] [git.owgps.net] acme: Obtaining bundled SAN certificate
obtain cert error: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order ::
urn:ietf:params:acme:error:rateLimited ::
Your account is temporarily prevented from requesting certificates for git.owgps.net and possibly others.

My web server is:
Nginx (managed via Nginx UI)

The operating system my web server runs on is:
Ubuntu Linux (22.04 LTS)

My hosting provider, if applicable, is:
Self-hosted / VPS (not using a shared hosting control panel)

I can login to a root shell on my machine:
Yes

I'm using a control panel to manage my site:
Yes, Nginx UI (using lego as the ACME client)

The version of my client is:
lego (invoked by Nginx UI; exact version not shown in UI)

Hello Let’s Encrypt Team,

We have been encountering HTTP 429 rate limit errors for the domain git.owgps.net for over two months, which appears to be far beyond the normal rate limit periods.

The issue was originally caused by a configuration mistake that resulted in repeated and prolonged certificate request retries for this domain. This was not intentional abuse.

Since then, we have taken the following corrective actions:

• Identified and removed all duplicate ACME clients
• Disabled all automated retry mechanisms (cron jobs, systemd timers, containers)
• Ensured that only a single, manual certificate request is being made
• Confirmed that no background or repeated requests are being sent to Let’s Encrypt endpoints

Despite this, the domain git.owgps.net is still being rate-limited when requesting a certificate.

We would like to ask for your help to verify whether this domain or account is still under an active rate limit or stuck in a persistent rate-limited state, and whether it is possible to clear or reset it.

Thank you very much for your assistance.

[evan.huang]

Additional clarification:

Although the log mentions "bundled SAN certificate", the current request is for a single domain only: git.owgps.net.

No wildcard (*.owgps.net) or additional SANs are included in the request. The wording appears to be part of the Nginx UI / lego logging output.

At present, we are intentionally limiting all attempts to a single-domain request only.

[Patryk]

The hostname has been put on "pause" because of repeated failed attempts rate-limit (described here: Rate Limits - Let's Encrypt).

The error message returned by the ACME API endpoint will contain the "unpause" link, which you need to click through. The ACME client might truncate the message, so be sure to get the whole response to see it.

[evan.huang]

Thank you very much for the clear explanation.

This helps clarify why the rate limit persisted. I understand now that this is an SFE pause, not a standard rate limit. I will retrieve the full ACME error response, follow the unpause link, and retry the request only once afterward.

Thanks again for your assistance.