Hi, as a service provider we are getting series of 500s with “Error creating new cert” on attempted provisioning. Started around 2017-07-28 12:33 Pacific Time, likely going from letsencrypt/boulder/blob/538aeb4a439949de5cd7a91ce2b17ce21c64b24e/wfe2/wfe.go#L775 // Create new certifica…

We have found occurrences from well before Boulder Update to +d2af4a0 so please disregard this. I suspect this could be just combination of various transient issues surfacing similarly over time.

[image] mbwalas: Started around 2017-07-28 12:33 Pacific Time I suspect you saw these errors transiently during the Boulder upgrade maintenance window from components being restarted, not because of the content of the update itself. Hope that helps,

The last burst of issues we have seen were around 2017-07-31 22:12 Pacific Time which doesn’t correspond to any prod rollout (to my best knowledge). That is also the time window I sampled domains from.

Adding some details to the mbwalas report, as the problem is ongoing. 107/3087 ~ 3% of new-cert requests (from the last 8 days) we made for subdomains of sdp.certsbridge.com failed with “500 urn:acme:error:serverInternal: Error creating new cert”. On the other hand, for all other domains we had onl…

Thanks for adding more detail. I’ll raise this internally for more digging.

We too are seeing the error: “500 urn:acme:error:serverInternal: Error creating new cert”. We are reliably producing this error (100% of attempts fail for a specific list of domains) every 5 minutes (our back-off re-try period). What information can I provide to help debug?

If you could provide the list of domains that reliably fail, that would be helpful. We’ve dug into the problem a bit and are pretty sure it’s related to a slow database query in our rate limiting code, some of which changed recently. But we haven’t nailed down exactly why the query is slow. The list…

@jsha Thank you for your response. Here's the list. I notice it has a lot of TLDs. I'm not sure if LE's database design is impacted by that. Please let me know if I can assist in any other way. I'm happy to look at Boulder logs/source or whatever else. Thanks! 5636026810761216-fe1.pantheonsi…

We’re happy to let you know that we haven’t observed this issue since Aug 10, 10:18 PDT. This coincides with the last week’s planned Boulder push, so I guess the fix must have gone in with the new release. Do you have any more context on what could have caused these problems? I couldn’t find any ob…

Hi @stanwise , I'm happy to hear the problem hasn't resurfaced for you. [image] stanwise: Do you have any more context on what could have caused these problems? I couldn’t find any obvious fix in the changelog This was related to a new approach to calculating an existing rate limit that was …

Series of 500s with "Error creating new cert"

Help

Topic		Replies	Views
Unable to get new certs, "error creating new cert" 500 error Help	29	6997	April 10, 2018
Server 500 but certificate still issued Server	44	10661	September 18, 2017
Consistent 500's for new-cert (failing CAA for one domain) Issuance Tech	16	4900	September 18, 2017
Consistent 500 urn:acme:error:serverInternal: Error creating new cert Help	1	963	November 3, 2017
Internal Server Error (500) when creating certificates Help	3	2299	March 7, 2017

Series of 500s with "Error creating new cert"

Related topics