Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rate Limits

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 121 posts

Re: Rate Limits

#71

Post by makomk »

Achshar wrote: post #11
JoshTriplett wrote: post #7

Earlier quoted context omitted.

> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…

Those aren't really an option for me, I use shared hosting without command line access. I realize this is an issue specific to my case but I know many other people that have their own small sites running on similar hosting as mine.

Ah. I think the trouble is that Lets Encrypt was created and promoted by tech people like me who like having their own VPS with root access.

Re: Rate Limits

#72

Post by pfg »

jontro wrote: post #68
walrus01 wrote: post #46

I really don't see what problem people are having with the 'official' certbot CLI client. It's very straightforward. Even if you're not allowing it to directly mess with apache2 or nginx configuration files and want to run it in standalone mode. For example to get a certificate for my 'test' environment public facing smtpd: sudo ./certbot-auto certonly -v --standalone --standalone-supported-challenges http-01 -d mail…

I had a few issues debugging the callbacks fired for letsencrypt-auto (i.e. how --post-hook and --renew-hook) works. Almost hit the limit before I got it working

You can use the --test-cert or --dry-run flags for this purpose. The former just makes the client use the staging server (which has higher rate limits), while the latter uses the staging server to simulate renewal, stopping short of actually storing the staging certificates (in other words: ideal for testing renewal in production).

Re: Rate Limits

#73

Post by sofaofthedamned »

The official advice from LE about many subdomains is to combine them onto one cert with Subject Alternative Names.

This doesn't work for me - I used to do this with the Lego client using the DNS challenge for my registrar, Namecheap. Unfortunately by the second or third challenge it would hang and eventually give up. I didn't have the problem splitting the subdomains into seperate certs and running them 5 minutes apart.

The problem is likely in over restrictive rate limiting from Namecheap, but either way one of them needs to loosen up.

Does anybody else know about the Namecheap restrictions? I don't use their API for anything else but the LE DNS challenge (adding TXT records once every other month)

Re: Rate Limits

#74

Post by pfg »

sofaofthedamned wrote: post #73

The official advice from LE about many subdomains is to combine them onto one cert with Subject Alternative Names. This doesn't work for me - I used to do this with the Lego client using the DNS challenge for my registrar, Namecheap. Unfortunately by the second or third challenge it would hang and eventually give up. I didn't have the problem splitting the subdomains into seperate certs and running them 5 minutes apa…

If Namecheap sends a specific HTTP Status Code or a header like Retry-After when it performs rate limiting, this could probably be fixed in the lego DNS provider code for Namecheap. Do you happen to have any logs from when this happens? (Not sure how verbose the logging is and whether that information would be included, but it's worth a shot.)

Re: Rate Limits

#75

Post by [deleted] »

finnn wrote: post #47
toomuchtodo wrote: post #40

Earlier quoted context omitted.

At fully loaded engineer costs, if someone takes more than an hour or two to investigate, its already more expensive than a wildcard cert.

The few times I've had Let's Encrypt's automation fail it's taken a few minutes, not hours, to investigate and fix. Anecdotal, sure, but I don't see it taking hours to fix

[deleted]

Re: Rate Limits

#76

Post by [deleted] »

JoshTriplett wrote: post #39
ryandrake wrote: post #32

Earlier quoted context omitted.

I experimented with LetsEncrypt a few months ago, and found the process to be VERY manual. This was on a bog-standard Debian install running common web software (lighttpd) with a few vhosts. Certbot does not seem to support lighttpd, so it's: download this third party script, run this, copy that, run this, cat these files together, restart the web server process, etc. Sure, that can all be cobbled together with your…

Even better than certbot supporting it would be if lighttpd supported ACME natively. You might file a feature request with lighttpd requesting native ACME/LE support.

[deleted]

Re: Rate Limits

#77

Post by Walkman »

Is it possible to request random certificates for a competing company which you know uses Letsencrypt? If yes, you could force them to not use Letsecrypt because of these limits. What count as an issued certificate?

Re: Rate Limits

#78

Post by [deleted] »

pfg wrote: post #45
Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

What certificate issuance through a public API (ACME) allows you to do is have your server software automatically request and deploy a certificate for your hostnames (like Caddy[1]). That's probably the simplest process you can get in this space, even compared to things like certbot (which does similar things, but is not a first-party component of the web servers it supports). There's no need for any kind of UI, the…

[deleted]

Re: Rate Limits

#79

Post by pfg »

Walkman wrote: post #77

Is it possible to request random certificates for a competing company which you know uses Letsencrypt? If yes, you could force them to not use Letsecrypt because of these limits. What count as an issued certificate?

You would not be able to increase any of the relevant rate limit counters without at least controlling a (sub)domain belonging to your competitor, or being able to send requests from the IP address your competitor is using to request certificates. There's no rate limit that would apply to your competitor short of that.

Re: Rate Limits

#80

Post by imaginenore »

Walkman wrote: post #77

Is it possible to request random certificates for a competing company which you know uses Letsencrypt? If yes, you could force them to not use Letsecrypt because of these limits. What count as an issued certificate?

How would you do that from the IP different from the one the domain points to?
Post reply on HN