# Retrieving already issued certs
**URL:** https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694
**Category:** Uncategorized
**Created:** [December 11, 2015, 2:49pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694 "2015-12-11T14:49:39Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 2:49pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/1 "2015-12-11T14:49:39Z")
I had to redo my installation with the addition of a new domain, and now I keep hitting the issue:
```
There were too many requests of a given type :: Error creating new cert :: Too many certificates already issued for: heroesofthestorm.co.za
Please see the logfiles in /var/log/letsencrypt for more details.
```
Can I retrieve the certs issued originally, or do I now have to wait 60 days to be able to get a cert again?
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [December 11, 2015, 2:51pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/2 "2015-12-11T14:51:59Z")
> [@DrPain](#):
>
> heroesofthestorm.co.za
All your Let's Encrypt certificates can be found here: [crt.sh Identity Search: Criteria Identity = 'heroesofthestorm.co.za'; Issuer CA ID = 7395](https://crt.sh/?q=heroesofthestorm%2Eco%2Eza&iCAID=7395)
But if you've lost your private keys and don't have a back up.. Good luck with that đ
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 2:55pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/3 "2015-12-11T14:55:27Z")
It sucks man, had like 2 hours of trying to fix servers last night, because hitting the rate limit meant all my domains didnât renew.
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 2:55pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/4 "2015-12-11T14:55:35Z")
Thanks for the info though
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [December 11, 2015, 2:56pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/5 "2015-12-11T14:56:48Z")
But I donât think youâll have to wait 60 days: [Public beta rate limits](https://community.letsencrypt.org/t/public-beta-rate-limits/4772)
But I donât know if the discussion is mainly about subdomains hitting the limit for the main domain or if itâs applicable for multiple certificates for the same domain over and over again.
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 2:57pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/6 "2015-12-11T14:57:50Z")
Still painful, one mistake and you are screwed if you have multiple domains / subdomains.
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [December 11, 2015, 3:00pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/7 "2015-12-11T15:00:44Z")
Well, the rate limit isnât exactly 1 per domain I believe and for experimenting/testing thereâs the staging server (`--server https://acme-staging.api.letsencrypt.org/directory`), which issues non-working certificates, but doesnât have as strict rate limits.
So I donât think the issue is exactly âone mistake and youâre screwedâ to be honest đ
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 3:04pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/8 "2015-12-11T15:04:23Z")
What exactly is the point of obtaining a non-working SSL cert, when you have nginx configuration which expects a working certificate to do a handshake?
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [December 11, 2015, 3:07pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/9 "2015-12-11T15:07:51Z")
You have generated 4 (!) certificates in almost exactly 2 (!) hours. Yes, your fourth one had three extra domains in its subjectAltNames, but the first three were exactly the same.
Experimenting with a live system is a good way to run into rate limits. đ By experimenting with the staging server, you could have avoided that. Finding out how the client works and when you were pleased with all the settings/switches, you could have switched from the staging server to the live server.
That way youâd have three non-working âexperimentâ certificates and a final, working one.
BTW, youâll have to wait [7 days](https://community.letsencrypt.org/t/beta-program-announcements/1631).
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 3:34pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/10 "2015-12-11T15:34:15Z")
Thanks for the info man. I am just super frustrated atm. I was running into issues where using the `-d example.com -d mail.example.com` for multiple domains, which would each time choose a different location to save the cert in. Even though the first domain specified stayed the same. Which in turn meant that you had to go and update all your virtual host configs in NGINX, not being sure which cert is the correct cert.
And yes like an idiot I went and deleted `/etc/letsencrypt` before trying to get the new certs, which failed. And led to 2 hours of downtime on 4 domains, and forced me to revert to a StartSSL cert.
Thanks for the advice, I will just need to maintain staging and live configuration and ensure that staging works before I do anything against live. I had to remove a domain and add a new one and this all cascaded into one giant mess since I issued a bundled cert originally.
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [December 11, 2015, 3:37pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/11 "2015-12-11T15:37:33Z")
In your defence, I tried to find anything about the `--server` switch in the FAQ, so one could experiment with the client options on the staging server first, but I couldnât find any info about that⌠Perhaps someone from Letâs Encrypt officials could add that to the FAQ?
---
### Author:  [@DrPain](https://community.letsencrypt.org/u/DrPain)
#### Post date: [December 11, 2015, 3:40pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/12 "2015-12-11T15:40:35Z")
Oh well, no use in crying over spilled milk. I do like letsencrypt, but do need to be more careful if I donât want to mess my setup up. I present you with this lama looking race horse as a token of my appreciation đ
---
### Author:  [@pfg](https://community.letsencrypt.org/u/pfg)
#### Post date: [December 11, 2015, 4:03pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/13 "2015-12-11T16:03:22Z")
The upcoming release will bring some updates in this regard, like a simple `--staging` flag (instead of passing the staging URL through `--server`) as well as doc changes encouraging users to start out with staging till everything looks good.
---
### Author:  [@Awatatah](https://community.letsencrypt.org/u/Awatatah)
#### Post date: [May 27, 2017, 3:49pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/14 "2017-05-27T15:49:12Z")
How exactly do you downloadâ these at this URL [https://crt.sh/?q=heroesofthestorm.co.za&iCAID=7395](https://crt.sh/?q=heroesofthestorm%2Eco%2Eza&iCAID=7395)? I hit my limit also by accident but I still have my private key.
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [May 27, 2017, 4:01pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/15 "2017-05-27T16:01:20Z")
Hitting the rate limit doesnât automatically and spontaneously delete already issued certificates from your hard drive?
Or did you accidentally delete the certificate(s) yourself?
---
### Author:  [@Awatatah](https://community.letsencrypt.org/u/Awatatah)
#### Post date: [May 27, 2017, 4:12pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/16 "2017-05-27T16:12:59Z")
I accidentally deleted themâŚ
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [May 27, 2017, 6:56pm UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/17 "2017-05-27T18:56:29Z")
You can click on the number in the â[crt.sh](http://crt.sh) IDâ column to view a specific certificate.
Once you have the right certificate in front of you, you can click on the link with the text âCertificate:â in the upper left corner of the biggest table field (containing all the certificate info) to download that cert.
---
### Author:  [@Awatatah](https://community.letsencrypt.org/u/Awatatah)
#### Post date: [May 28, 2017, 1:27am UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/18 "2017-05-28T01:27:31Z")
That is great! Is there a way to get the full chain?
---
### Author:  [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [May 28, 2017, 1:53am UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/19 "2017-05-28T01:53:43Z")
> [@Awatatah](#):
>
> That is great! Is there a way to get the full chain?
Generically, you can click on "Issuer" on the crt.sh page. That will give you the intermediate. You can then click one of the crt.sh IDs for one of the intermediate's certificates, and download it as above.
Generically, there can be a chain of multiple intermediates, so you may have to repeat that step.
Let's Encrypt's intermediates are subject to change, and any ACME client should automatically download the intermediates it's told to.
However, for your specific situation today, the fact is that all currently valid Let's Encrypt certificates use a single one.
You can download the "Letâs Encrypt Authority X3 (IdenTrust cross-signed)" certificate here:
> **[Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/)**
>
> Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root programs, we have also...
Or, more specifically:
[https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt](https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt)
Here's where it is on crt.sh, if you're curious:
> **[crt.sh | CA:16418](https://crt.sh/?caid=16418)**
>
> Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA)
> **[crt.sh | 15706126](https://crt.sh/?id=15706126)**
>
> Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA)
---
### Author:  [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [June 15, 2018, 5:17am UTC](https://community.letsencrypt.org/t/retrieving-already-issued-certs/6694/20 "2018-06-15T05:17:34Z")