I can't find the earlier forum thread about this (and I've searched for it), but I remember that someone had proposed that there should be a more aggressive duplicate certificates limit with a 1-hour or 1-day reset, so that people would hit it much sooner when doing a wasteful reissuance (and hopefu…

You mean this one? :slightly_smiling_face: [image] Add an Hourly Duplicate Certificate Rate Limit Feature Requests I… I closed the issue because it seemed like it wasn't going anywhere, but I'm happy to reopen it.

Yep, that one! I feel like the frequency of people hitting rate limits because of ephemeral instances has been increasing. So, if my perception is right, I feel like this proposal is increasing in relevance with time.

I'm perhaps wandering off topic but I've long felt that ephemeral instances (and many more permanent internal systems) shouldn't really be acquiring certs from the CA directly (especially if DNS validation is involved) and instead should be going via centralised cert management so that fancy validat…

[image] webprofusion: I'm perhaps wandering off topic but I've long felt that ephemeral instances (and many more permanent internal systems) shouldn't really be acquiring certs from the CA directly (especially if DNS validation is involved) and instead should be going via centralised cert manage…

Thanks! In the first instance I'm going for trivial download from a known API using pre-shared app/service specific credentials/tokens (likely with an option for mutual tls if API requests could happen over the public internet). I thought about an ACME proxy and actually did build a working prototy…

Issue against Boulder has been reopened. :slightly_smiling_face: Add an Hourly Duplicate Certificate Rate Limit opened 09:12AM - 22 Dec 20 UTC (UTC) [GriffinSoftware] GriffinSoftware …

[image] There were too many requests of a given type :: Error creating new order :: too many certificates already issued Help H… Another example where this would have been useful, following the "never knew there was any limit!" pattern.

[image] webprofusion: there are of course several systems that do this already but I've no idea what the uptake is. I opens-ourced our API Driven ACME Client/Manager a while back -- Peter SSLers . Our own use-case is to support an unknown number of domains, running on an unknown number of ser…

Thanks for your insights Jonathan, your project is incredibly sophisticated, I think I'm pitching at a simpler level overall :slight_smile: - nice work!

Thanks! We are definitely aimed at completely different use cases -- my project is aimed at simplifying "internet scale" deployments like PAAS, SAAS, Whitelabel Tools, etc and programmatic usage. The UX is an afterthought, for bugfixing. It is overkill for 99.9% of use cases, which is why I even …

Soft rate limit

Issuance Policy

schoen April 5, 2021, 7:14pm 8

Another example where this would have been useful, following the "never knew there was any limit!" pattern.

Topic		Replies	Views
Notification before rate-limit reached Feature Requests	47	2795	November 30, 2020
Add an Hourly Duplicate Certificate Rate Limit Feature Requests	10	1906	December 22, 2020
Public beta rate limits Issuance Tech	131	64424	December 22, 2016
Switching the “Duplicate Certificate limit” to an even number Feature Requests	36	3741	February 13, 2022
New rate limit question	22	8854	April 19, 2016

Soft rate limit

Related topics