Poll_authorizations limits

Help
1

Hi, I am building python script with acme library and want to integrate pre-validation of the domain before SSL certificate is actually going to be signed.

I use poll_authorizations method from ACME library. Can I use this freely or do I have to take care of limits like when signing SSL certificate? I think there are some limits like 50 requests per week per domain or something like that.

Thanks,
Zdenek

2

LE doesn't really do preauth, so not much information about it: if you do some hackery and make dummy order as preauth, you'd have 300 new orders per 3 hour (rolling window).

1 Like
3

yeah order is what I am bit worried about, sorry for not specifying it in original post.
order = self.client.new_order(csr.encode())

So if that is 300 per 3 hours (I guess for domain, not a client) then we should be fine.

Thank you for your answer,
Zdenek

4

You should review Integration Guide - Let's Encrypt
It is helpful for any ACME Client author especially if this is service/product

All the Rate Limits are: Rate Limits - Let's Encrypt

You might consider using the Let's Encrypt Staging server for just your authorization testing. Much more relaxed rate limits and not consuming LE production resources. Although, I'm not sure why you wouldn't just issue a cert if the auths succeed and report the failure if not.

Another good topic to read from the /docs/ selection is the one for Profiles.

3 Likes
5

Out of interest, what scenario are you trying to achieve by using pre-authorization?

4 Likes
6

to prevent starting the overall flow with CSR creation etc when it is obvious that domain validaiton is not going to be passed. But looks like even when only using poll_authorizations I need to have "order" creates beforehand, that means CSR anyway needs to be created. So I am bit stuck and maybe will not implement any prevalidation at all.

7

Are you working with domains you don't control (e.g. customer domains) or are you working with your own domains?

Are you using http domain validation or DNS validation?

8

To be clear, the ACME protocol does not require a CSR until finalization. It looks like the library you are using requires the CSR to be provided up-front in order to create a new order, but other libraries do not have that restriction.

4 Likes
9

I use acme library in python

10

Combination, I wanted to have it bit more user friendly and save resources when it's clear domain validation would fail