# Problem getting certificate re-issued; cPanel AutoSSL and rate limit **URL:** \ **Category:** Help\ **Created:** [October 1, 2021, 12:51pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566 "2021-10-01T12:51:57Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![PvxPlus](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@PvxPlus](https://community.letsencrypt.org/u/PvxPlus)\ **Post date:** [October 1, 2021, 12:51pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/1 "2021-10-01T12:51:57Z")
We have a problem with getting our certificate re-issued as we have hit our DCV rate limit. We have a number of domains most of which have been updated to the new certificate -- all **except** the certificate assigned to our mail server. As such people are not able to send us mail (and the reason I signed up not using my corporate mail server account). How can I get past this rate limit so my mail server certificate can get updated? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 1, 2021, 12:57pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/2 "2021-10-01T12:57:43Z")
> [@PvxPlus](#): > > How can I get past this rate limit so my mail server certificate can get updated? I can think of several ways: - wait for the timer to expire - add or remove an entry into the SAN of the cert you require - use another FREE CA - there are several to choose from - change the name of your mailserver - travel back in time and stop yourself from exceeding the rate limit and save the planet! ---
**Author:** ![Lapa](https://avatars.discourse-cdn.com/v4/letter/l/f08c70/32.png) [@Lapa](https://community.letsencrypt.org/u/Lapa)\ **Post date:** [October 1, 2021, 12:58pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/3 "2021-10-01T12:58:42Z")
Free CA that offer wildcard one? If yes which one, I can't find any of them ☹ ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 1, 2021, 1:01pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/4 "2021-10-01T13:01:39Z")
@Lapa Try: `ZeroSSL.com` `BuyPass.com` [I don't use either - so I can't speak from experience] ---
**Author:** ![Lapa](https://avatars.discourse-cdn.com/v4/letter/l/f08c70/32.png) [@Lapa](https://community.letsencrypt.org/u/Lapa)\ **Post date:** [October 1, 2021, 1:05pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/5 "2021-10-01T13:05:27Z")
Thanks you very much, but both of them are not free for wildcard certificat. LE just killed a part of my user base from a day to another. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 1, 2021, 1:06pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/6 "2021-10-01T13:06:44Z")
> [@Lapa](#): > > killed a part of my user base Which part got killed? [I'm here to help you find answers] ---
**Author:** ![Lapa](https://avatars.discourse-cdn.com/v4/letter/l/f08c70/32.png) [@Lapa](https://community.letsencrypt.org/u/Lapa)\ **Post date:** [October 1, 2021, 1:11pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/7 "2021-10-01T13:11:57Z")
Every users which are not supported by ISRG Root X1 but were for DST Root CA X3 Actually many of them won't update their system and will be clueless about all of that. ---
**Author:** ![PvxPlus](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@PvxPlus](https://community.letsencrypt.org/u/PvxPlus)\ **Post date:** [October 1, 2021, 3:44pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/8 "2021-10-01T15:44:55Z")
Thanks -- I kinda knew if I waited it should go away but not receiving mail on our server for a week seemed a non-starter of a solution. We are using cpanel/whm for the site and their AutoSSL utility so I really don't have direct control over when the requests go out -- and not certain why the limit was hit. Anyway the quick solution I came up with was to replace the AutoSSL certificate with a wildcard certificate we have inhouse that we use on test servers. That has an expiry of July 2022 -- although it didn't cover all the Domains that were in the AutoSSL request -- however those domains aren't that important (e.g. our .ca domain which is simply a redirect to our .com). Next week (once I have served my time) I will remove the wildcard SSL and try to get a new Let Encrypt certificate .. Lets hope Lets Encrypt will allow that. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 1, 2021, 4:01pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/9 "2021-10-01T16:01:57Z")
@PvxPlus I read something about how cPanel verifies a cert and it created like almost a denial of service loop because it is unable to verify a cert correctly once a trust store root path has expired [which covers what has happened here - since almost 24 hours now] If that is the case with your cPanel, it might not be able to verify LE certs (ones that use the long "old Android friendly" chain) and may loop and be rate-limited yet again. [don't quote me on any of this - and keep an eye out for any cPanel patches/updates to address this] ---
**Author:** ![PvxPlus](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@PvxPlus](https://community.letsencrypt.org/u/PvxPlus)\ **Post date:** [October 1, 2021, 7:17pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/10 "2021-10-01T19:17:48Z")
Here is what I believe happened -- All my certificates when verified by Cpanel's AutoSSL logic failed verification due to the expired X3 certificate. As a result all my certificates got resubmitted to LetEncrypt to get updated however the update process didn't update the it CA Bundle since technically the R3 certificate hadn't changed. Sadly that meant it didn't reset the certificate above in the chain that so the old X3 certificate hung around. Anyway the cure was to manually delete the CA bundle certificates presented by CPanel. It had to be done on every domain. Now the SSL update AUTOSSL check runs clean and all I likely need to do is wait it out to get my mail certificate back on LE. The crux of the problem was that Auto SSL kept hitting LE with requests since all certificates failed due to the CA chain not being properly updated. So for others using CPanel -- go into your SSL/TLS page, select Manage SSL Sites, then call up all your site and clear the CA Bundle information -- CPanel will re-upload with the correct value. HTH -- It worked for us. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [October 1, 2021, 7:28pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/11 "2021-10-01T19:28:13Z")
> [@rg305](#): > > read something about how cPanel verifies a cert and it created like almost a denial of service loop because it is unable to verify a cert correctly once a trust store root path has expired Yes, good summary. The nature of the problem is discussed over here: [Choice of default long chain vs short chain - #20 by rg305](https://community.letsencrypt.org/t/choice-of-default-long-chain-vs-short-chain/161184/20) Essentially, AutoSSL was using a different technique to validate the downloaded chain, and as a result failed to validate chains and went into a retry loop. It sounds like a fix is coming soon. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 31, 2021, 7:28pm UTC](https://community.letsencrypt.org/t/problem-getting-certificate-re-issued-cpanel-autossl-and-rate-limit/161566/12 "2021-10-31T19:28:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.