Too many certificates already issued - rate limit?

Let’s Encrypt basis its rate limit on the “registered domain” portion part of the FQDN, based on the Public Suffix List. For www.example.com, that would be example.com. For www.example.appspot.com, that would be example.appspot.com (because appspot.com is a public suffix).

Most dynamic DNS services should probably be in the Public Suffix List, because that’s what browsers use to prevent sites from setting cookies on each other. Otherwise, example.appspot.com could set and delete cookies from widgets.appspot.com. So, my first recommendation is to ask your dynamic DNS provider to add themselves to the Public Suffix List, which will have add-on security benefits.

2 Likes