New Authz rate limit in Staging

[cpu]

@lancedolan

What you’re saying here I think is unfair: this problem is one and the same, not mounting evidence. The “malformed request problem” caused the newauthz rate limit. We’re trying to solve the “malformed request problem.” It’s not fair to point to the 2 symptoms of our 1 current issue and cast them as multiple evidence that we’re just unstable. I have the fear, though you haven’t said it explicitly and so I could be wrong, that you’re thinking we’re not worth helping through this problem because you’re seeing us as just generally unstable perhaps?

I'm certainly not trying to dissuade anyone from helping you. I apologize if I was overly terse or too quick to suggest that you might benefit from an architectural reevaluation. I still believe that Certbot as you are using it is likely to cause you continued difficulties but I'm willing to table that suggestion if you disagree.

@lancedolan

Also it’s our eventual goal to re-write the solution entirely to use DNS auth and acquire wild-card certs, so any architectural changes or refactoring we’d do now would be sort of a waste.

OK, I can understand hesitation to drastically rework the existing system if you already have an ACME v2 & DNS-01 approach in the works.

@lancedolan

What we need is to clear out the new authz limit immediately.

I'm still unclear why a pending authorization rate limit in the staging environment is affecting your production renewals.

@lancedolan

I can do this process, and will begin on it when I’m done with this post, but I estimate it could take a day or more, and was really just hoping that there would either be a more explicit, simpler process or maybe even that since this is just staging

I'm afraid there is no other procedure.

@lancedolan

I’ve never written go, but believe this is a command line tool, that would be used something like this:

go run main.go /path/to/certbot-key.json

Yup, to be explicit you'll also need to follow the Go setup instructions, and then get the dependencies for that tool:

1. go get golang.org/x/net/context
2. go get golang.org/x/crypto/acme
3. go get gopkg.in/square/go-jose.v2

@lancedolan

What am I looking for in my logs in order to find a “leaked” auth?

A response from the new-authz endpoint that wasn't later used in a POST request to a challenge.

@lancedolan

Once found, what info do I put into the command, after the path to the certbot key?

Nothing. It looks like you run the tool and it reads authorization URLs from STDIN. You can provide those from a file by using normal shell procedure ("< authz_urls.txt").

This tool was written by @_az - they might be able to provide more concrete guidance.