Pending authorization - Ratelimit

Issuance Tech
1

We are hitting rate-limit of pending authorization with below message. The other problem here is they are not getting successful or fail too soon.

Error creating new order :: too many currently pending authorizations

Because of many of the domain staying in the pending state we are hitting rate-limit here.

Below two things will help here.

  1. How we can find out root cause why they are stuck in pending state?
  2. Is there any way to remove them manually from pending state?

We tried following steps from below document but we were getting error which is asking googleaccessId.

2

LE doesn't ask googleaccessID: what client you are using?

3 Likes
3

We are using Lua Resty Auto SSL https://github.com/auto-ssl/lua-resty-auto-ssl.

4

looks like that client isn't able to handle that ratelimit, and breaks if you ask too many certs by it

3 Likes
5

You can read more about the pending authorizations rate limit here: Rate Limits - Let's Encrypt

You hit the Pending Authorizations limit when you have many authorizations still pending at the time you try to create new ones. You probably have many authorizations pending because you're creating many New Orders, and then not fulfilling the challenges for those orders. This might be because you've written your client to place many orders in parallel, or it might because your client is failing somewhere along the way and leaving old orders behind.

You can fix this in two ways:

  1. make sure your client actually attempts to fulfill every authorization/challenge it creates, and doesn't leave them hanging around.
  2. make your client delete old pending authorizations by deactivating them. Not all clients have the ability to do this built in, but it is supported by some.
3 Likes
6

It does and is different from the too many new orders recently rate limit.

4 Likes
7

I was thinking about googleaccessID but screw the wording (it doesn't appear in RFC8555 so have no idea where it got from)

3 Likes
8

Ah, indeed, no clue how googleaccessID fits in this all.

4 Likes
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.