University Issue Rates

I think that makes some amount of sense - effectively, treat *.edu as a Public Suffix, so each subdomain.example.edu would get its own rate limit bucket. However, as @patwww's comment points out, there are lots of university domain names that don't end in .edu.

Another approach we've been meaning to work on for a while: Changing how renewals get counted against rate limits. Right now, you can always renew (the Renewal Exemption), but those renewals do count against your overall limit. So if you control all subdomains, you'd want to cluster up renewals so that you have wide-open chunks of time where you can issue new certificates. Even in that situation, it's a pretty annoying coordination problem, and in the university case it's basically impossible. If we make it so renewals aren't counted at all, it would probably solve most of these University use cases, at least under non-malicious scenarios (your neighbors at other departments would still be able to scoop up all your rate limit for new issuances if they wanted to, but probably would not).

2 Likes