Good afternoon! We work through the platform https://tilda.cc/, which issues security certificates for websites. On Friday, we changed the IP addresses of some subdomains, about 50 of them, because the Tilda platform requested it. Then the security certificates stopped working. Since Friday, we've been resending them every day without success. What's the problem? We've followed all the possible instructions from the Tilda service, but nothing helps. What's the problem?
Tilda should reuse previously used certificates, but I suspect the engineering effort is not there. There's also an option for Tilda to apply for increased rate limits Rate Limits - Let's Encrypt
You got a single cert for a large number of domains about an hour ago. And, routine testing shows those domains are using this new cert. I did not check every name
It looks like Tilda just took longer to complete all the steps.
Since Tilda is a managed service, there's very little you can do on your end if they run into Let's Encrypt's rate limits. Perhaps pester their support team to better manage certificates, or to request increased rate limits, as I mentioned in my previous post. Or switch to another service entirely.
The form to increase the rate limit is at the end of the rate limits documentation Rate Limits - Let's Encrypt although I'm not sure if it will be accepted given that your hosting provider is the one getting the certificates.
i think he can ask for rate limit adjust about warpoint.ru domain as owner of that domain.
not sure why OP can't use same wildcard for everything though
I have some familiarity with the Tilda service. I suspect that's their limitation — they support neither uploading of custom certificates, nor the use of DNS-01 challenge to get the wildcard themselves.
Why do you think this is a rate limit problem? A cert was issued yesterday morning with those domains. It is too bad the SSL Labs site has been down as it showed successful connects. (update: SSL Labs is back up. my prior link to that shows an A grade for kolomna.warpoint.ru)
From my own test server this morning I can also connect. Here's a partial from openssl commands
crt.sh often does not work reliably so here is a snip of recent cert results. Even looking at Dec30 issuance there isn't an obvious rate limit problem with 8 certs issued. They must have used different combinations of domain names to avoid the 5 identical certs per week limit.
If it's not a rate-limit issue, then I'm not sure what else it could be. In my experience Tilda requests certificates with SANs containing only www.[sub.domains.]example.com and [sub.domains.]example.com, which could easily run into limits. If my weak censys-fu is not completely wrong, there are already more than 50 certs for this domain in the last week.
Hmm. If that domain is shared service shouldn't it be on the Public Suffix List (PSL)? If not then yes it looks like it should complete a rate limit form as described earlier.
Looking just at chelny.warpoint.ru on censys for the past year I see some certs for just its apex and www subdomain but even more certs where it is just one of many domains in the cert. The most recent apex/www cert for that domain expired in Oct23 2025.
Definitely can be a problem if Tilda or the warpoint system needs that apex/www cert but at least with chelny this isn't a new problem. Nothing wrong with chelny itself (at least for certs) because it appears in a large cert issued Feb2.
Thank you all for your help! We solved the problem by switching our account to a different country, and the certificates started to be issued almost immediately, but we encountered a limit of 50 domains. Additionally, we tried to switch back to the previous country as an experiment, but it didn't work again. The issue lies with the tilde, as their data is not being transmitted or accepted properly on certain servers, and their technical support consists of clowns.
But, your cert request process has not been good for a long time. Below just covers back to last April. Frequently you were getting certs with just your main domain and its www. Normally you would renew a cert every 60 days but you got 8 certs from Apr thru Aug9 where you would normally just need 2.
Then the one from Aug31 expired Nov29. After that the certs for those two names were combined in a cert with a large number of names. Those should have been fine to use but also showed inconsistent renewal requests.
Your most recent cert looks like the ones you got during last summer.
All of these certs should have been fine to use for kolomna. There was never a period without a cert that included kolomna. I don't know what you mean by the "security certificates stopped working". Without more details about what the exact error would be needed for us to say more. But, whatever is getting certs has been doing it poorly for a long time.
