The CW Corner – Avoiding and Resolving Let’s Encrypt Rate Limits

by Charles Oropallo | Jan 17, 2025 | Security, Technical Help

Recently, I encountered an issue while attempting to renew an SSL certificate for one of my domains, (let’s call it) testdomain.com, using Let’s Encrypt on a server running Virtualmin on Debian 12. The process was more complicated than I expected due to a small oversight that many others could easily make. This article details my experience, the errors I encountered due to Let’s Encrypt rate limits (which I didn’t know existed), and steps to avoid or resolve such issues.

The Problem: Let’s Encrypt Rate Limits for Failed Authorizations

A padlock that shows with an encrypted site using https in some browsers.

Let’s Encrypt provides free SSL certificates for securing websites. However, it enforces rate limits to ensure fair usage and prevent abuse. While attempting to renew the SSL certificate for testdomain.com, I discovered that the DNS settings were not pointed to my server, causing repeated failed validation attempts. By the time I fixed the DNS settings, I had hit Let’s Encrypt’s rate limit for failed authorizations.

This limit restricts requests for the same domain to 5 failed attempts per hour. Once you hit this limit, you must wait for the cooldown period to expire before trying again.

How the Error Appeared in Virtualmin

In the Virtualmin interface, I attempted to renew the certificate by navigating to:

1. Virtualmin > Server Configuration > SSL Certificate
2. Clicking on the Let’s Encrypt tab
3. Ensuring the domain and subdomain (e.g., testdomain.com and www.testdomain.com) were selected
4. Clicking the Request Certificate button

The renewal process failed with an error that Virtualmin reported as “an unknown issue.” Upon further investigation, I found the detailed error logs in the Let’s Encrypt log file located at:

/var/log/letsencrypt/letsencrypt.log

From the log, I saw this message:

urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: too many failed authorizations (5) for "testdomain.com" in the last 1h0m0s, retry after [time].

Understanding Let’s Encrypt Rate Limits

Let’s Encrypt enforces several types of rate limits. Here are the key ones:

1. Failed Validation Limit:
   • 5 failed validations per domain per hour.
   • This applies to any validation failure, such as DNS misconfigurations or inaccessible .well-known/acme-challenge directories.
2. Duplicate Certificate Limit:
   • 5 identical certificates per week.
   • If you request the same set of domains repeatedly, you’ll hit this limit.
3. Certificates per Registered Domain:
   • 50 certificates per registered domain per week.
   • All subdomains count toward this limit.
4. Account-Level Requests:
   • 50 certificates per account per week.

These limits are described in detail at Let’s Encrypt’s rate limit documentation.

Diagnosing the Problem

If you encounter a similar issue, here are the steps to diagnose and resolve it:

1. Check DNS Settings

• Ensure the domain’s DNS A records correctly point to your server.
• Use tools like dig or online DNS propagation checkers to verify.

2. Verify Webroot Accessibility

• Let’s Encrypt uses the webroot method to validate domains by creating files in the .well-known/acme-challenge/ directory.
• Ensure this directory is publicly accessible. You can test it by creating a file and accessing it in a browser:

  http://testdomain.com/.well-known/acme-challenge/test-file

3. Examine Let’s Encrypt Logs

• Detailed logs are stored at:

  /var/log/letsencrypt/letsencrypt.log

• Look for messages indicating a rate limit or validation failure.

4. Check Cooldown Period

• If you’ve hit the rate limit, the log will indicate a Retry-After time in UTC. Convert it to your local timezone to determine when you can retry.

5. Dry Run Your Request

• Before making a live request, use Certbot’s --dry-run option to test:

  certbot certonly --webroot -w /path/to/webroot -d testdomain.com -d www.testdomain.com --dry-run

Steps to Avoid Future Issues

1. Ensure DNS Settings Before Requesting Certificates

• Double-check that DNS records point to the correct server and have propagated globally before initiating an SSL request.

2. Test Webroot Configuration

• Verify that the .well-known/acme-challenge/ directory is accessible for all domains you’re requesting.

3. Use the Dry-Run Option

• Always test with --dry-run before making a live request to avoid hitting limits.

4. Automate Renewals

• Virtualmin and Certbot support automated renewals. Ensure the cron job is configured correctly and DNS remains stable.

5. Avoid Forcing Duplicate Requests

• Options like --duplicate and --force-renewal can lead to unnecessary requests. Only use them when absolutely necessary.

Conclusion

Hitting Let’s Encrypt’s rate limits can be frustrating, but understanding the causes and solutions can save time and effort. By checking DNS settings, verifying webroot accessibility, and using dry runs, you can prevent failed authorizations and avoid cooldown periods.

If you’re using Virtualmin, remember to check the Let’s Encrypt logs for detailed error messages, and plan your certificate renewals carefully to stay within the rate limits. Hopefully, my experience with testdomain.com helps you navigate and prevent similar issues.

As always, proactive testing and attention to detail go a long way in maintaining a secure and smoothly running server.