PSL - too many certificates for registered domain

Issuance Policy
1

Hi,

We have the following domain on the Public Suffic List - sub.example.com.
We can properly get certificates for *.sub.example.com however when we try to get a certificate for *.another.example.com we hit the following rate limit:

{ type: 'urn:acme:error:rateLimited',
detail: 'Error creating new cert :: too many certificates already issued for: example.com',
status: 429 }

There’s only one certificate issued for www.example.com and example.com domains which can be properly renewed every two months via certbot.

According to the rate limits we should be able to get new certificates for *.another.example.com since we’re not hitting the 20/week certificates limit for registered domains.

Is this correct?

2

This was a bug, but it was fixed in May… Maybe there’s a regression, or corner case?

What’s your domain? Maybe there really were 20 sundry certificates issued recently.

3

@mnordhoff - I remembered there was such a bug, but couldn’t find it. Thanks.
The domain is evennode.com

4

@mnordhoff - any ideas what could be wrong?

5

@cpu, do you have any code that can easily replicate the rate limit calculation given a Public Suffix List listing of at least some subdomains? It seems possible that the PSL logic is being applied incorrectly here, or maybe that this organization is issuing enough certificates under their top-level domain (which isn’t on the PSL) to cause problems.

Or is it possible that if you have foo.example.com on the PSL and don’t have example.com on the PSL, issuance under example.com that reaches the certificates per registered domain rate limit could also prevent foo.example.com from issuing?

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.