Unexpected registration rate limiting error

[quote=“jcjones, post:20, topic:2157”]
As of today:

Registrations per IP is 10 registrations per 3 hour window.
Certificates per name is 10 certificates per 59 days.
Pending registrations per account is 300 per 1 week.
[/quote] thanks for the info @jcjones

Im a linode customer in the Newark Datacenter, and i can still not register. Its giving me the too many registrations error.

I’m another Linode VPS user having problems.

As a temporary solution, disable IPv6 with:
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1

issue your Let’s Encrypt certificate,

and re-enable IPv6 with:
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0

The above works on Ubuntu/Debian.

1 Like

I am currently having the same issues. Before I registered the first certificate I got the ‘Too many registrations from this IP’ error. After reading all the related articles about this particular error I think temporarily disabling IPv6 would solve the issue but I refuse to do so.
Why should I be forced to disable IPv6?

My machine got assigned one /64 network inside a /48 inside a /32 from the same datacenter provider.

Regards

guess this issue still is relevant for IPv6 users https://github.com/letsencrypt/boulder/issues/1046#issuecomment-161999507

If you’re running Linux and are running into this problem with IPv6, you can use sysctl to disable IPv6 temporarily.
sysctl -w net.ipv6.conf.default.disable_ipv6=1
sysctl -w net.ipv6.conf.all.disable_ipv6=1

Set the variables back to zero to re-enable IPv6 once you’re done.

You’ll want to restart your Ethernet device as well:
ifdown eth0 && ifup eth0

I’ve set up a crontab to reissue “letsencrypt-auto certonly --standalone …” every month to renew the certs. But this will run at the same time on each host (requests will be from different IPs) but using the same email address. Hopefully this use case won’t trip up your rate control scheme.

My problems vanished a few hours after posting my problem.

Just got my head around registration/renewal with the simpl_le client, got it working for the first one and then automated it to do the other 11 domains and I’ve hit the rate limit. Oops. :smile:

I’m also IPv4/IPv6 dual stack (Rimuhosting this time, using a Hurricane Electric tunnel), but I think this is a real rate limit for me. :blush:

Now I’m assuming that this will only affect the initial registration for the domains I run (all personal or not-for-profit) and so when it comes around to renewal time this won’t happen again?

Thanks so much to all involved with this project for getting this going!
Chris

I have got a similar problem here. Received the message

An unexpected error occurred:
There were too many requests of a given type :: Error creating new cert :: Too many certificates already issued for: example.nl
Please see the logfiles in /var/log/letsencrypt for more details.

The log does not show any more information.

My specific problem is that I have a lot of subdomains using my example.nl domain. Like cloud.example.nl, cdn.examplen.nl, static.example.nl, mail.example.nl etc etc and I would love to all use these - sometimes different - servers with this domain. Anyone an idea?

Maybe you hit the limit of “10 per IP per 3 hours”?
This would mean, to me, that a single certificate can’t include more than 10 vhosts?

You'll probably want to set it up so that all 12 of your domains are in the same certificate, so you don't hit the rate limit come renewal time.

1 Like

Is the pending registrations per account still the case in the public beta?

Yes, the current rate limits are;
Rate limit on registrations per IP is currently 10 per 3 hours
Rate limit on certificates per Domain is currently 5 per 7 days

Okay I found out “300 registrations per account per week” is still the case by doing 300 requests to new-authz. I would like this limit removed as it seems unnecessary. Why is it there, what does it prevent? It definitely doesn’t prevent DoS attacks.

There’s a limit of 300 pending (unevaluated, the outcome doesn’t matter) challenges per account, from what I’ve read.

I think 5 cert’s per domain for 1 week!! is also not necessary,

1 Like

It's actually Pending Authorizations Per Account, and when combined with Account Registrations Per IP it places an upper bound on how many rows someone can add to one of our databases in a given time limit.

1 Like

5 certs/domain per week is very low. Any hope to bump it up a bit? Or a way to reset the counter? I hit the limit with production environment :frowning:

1 Like

There is no way to reset the counter.

Can I ask how you managed to hit the limit in a production environment ? (assuming you weren’t testing in a production environment).

There may be alternatives