# Rate Limits clarification

**URL:** <https://community.letsencrypt.org/t/rate-limits-clarification/39568>\
**Category:** Issuance Policy\
**Created:** [August 5, 2017, 10:53am UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568 "2017-08-05T10:53:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![amqphosting](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@amqphosting](https://community.letsencrypt.org/u/amqphosting)\
**Post date:** [August 5, 2017, 10:53am UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/1 "2017-08-05T10:53:31Z")

</div>

I’m a bit confused by the letsencrypt rate limits document; [https://letsencrypt.org/docs/rate-limits](https://letsencrypt.org/docs/rate-limits).  
Specifically, as it relates to `Duplicate Certificate limit of 5 certificates per week` and `Renewal Exemption to the Certificates per Registered Domain limit`.

So let’s say I am a web hosting company and I request letsencrypt for a SAN certificate that has 100 names in the certificate. Now lets say, I deploy this  
certificate to 100 different servers. I also add a script to all those 100 servers to auto-renew the SAN certificate after 80days.

So my question is:  
Will all the 100 renewal requests succeed or will only 5 of them succeed?

---

<div class="post-metadata">

**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\
**Post date:** [August 5, 2017, 11:41am UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/2 "2017-08-05T11:41:57Z")

</div>

My understanding is that all of the renewal requests will succeed, because renewals are not blocked by this rate limit. Until recently, after the first 5 renewals you would be unable to issue new certificates for that set of domains, but I believe they’ve reorganized how that’s handled a bit.

---

<div class="post-metadata">

**Author:** ![amqphosting](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@amqphosting](https://community.letsencrypt.org/u/amqphosting)\
**Post date:** [August 5, 2017, 11:50am UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/3 "2017-08-05T11:50:36Z")

</div>

Hi @jared.m  
Thanks for answering.

But from the doc:  
`Renewals are still subject to the Duplicate Certificate limit`  
That assertion in the rate-limit docs seems to contradict what you are saying.

English is not my first language so maybe I’m reading the documentation wrong.  
As an aside; the language in the rate-limit doc sounds legalese-like

---

<div class="post-metadata">

**Author:** ![jmorahan](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jmorahan/32/1873_2.png) [@jmorahan](https://community.letsencrypt.org/u/jmorahan)\
**Post date:** [August 5, 2017, 12:10pm UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/4 "2017-08-05T12:10:13Z")

</div>

If each of your 100 servers tries to renew the _same_ SAN certificate, with the same 100 names, then each attempt will generate a new and different certificate for the same set of names. This will indeed hit the rate limit once 5 such certificates have been issued.

Instead you should renew the certificate once, and distribute the renewed certificate to your 100 servers the same way you did when you issued it originally.

---

<div class="post-metadata">

**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\
**Post date:** [August 5, 2017, 12:55pm UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/5 "2017-08-05T12:55:29Z")

</div>

Whoops, it was definitely too early when I read this. Yes, the identical certificates will hit this limit. Renewals only avoid the certificates per registered domain.

---

<div class="post-metadata">

**Author:** ![amqphosting](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@amqphosting](https://community.letsencrypt.org/u/amqphosting)\
**Post date:** [August 5, 2017, 1:26pm UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/6 "2017-08-05T13:26:12Z")

</div>

> <https://github.com/letsencrypt/boulder/issues/2943>

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 4, 2017, 1:26pm UTC](https://community.letsencrypt.org/t/rate-limits-clarification/39568/7 "2017-09-04T13:26:29Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
