Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rate Limits

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 121 posts

Re: Rate Limits

#101

Post by bigiain »

michaelt wrote: post #35

I wish they didn't have the limit of 20 certs per registered domain. There are a lot of use cases this blocks - Plex's use case [1] where they issued certs for all their users; large organisations (I'm sure there are more than 20 sites run under .mit.edu sites by different teams who wouldn't want to share multi-name certificates); and of course using ISP-assigned hostnames like host86-186-141-3.range86-186.btcentralp…

Isn't that an entirely appropriate use case to say "So you'll be wanting to spend a hundred or two dollars on a wildcard cert from a vendor who sells those then"?

Just because my local pub runs a free shuttle bus to the train station, that doesn't mean they are obligated to transport my bulk freight for them.

Re: Rate Limits

#102

Post by bigiain »

sofaofthedamned wrote: post #73

The official advice from LE about many subdomains is to combine them onto one cert with Subject Alternative Names. This doesn't work for me - I used to do this with the Lego client using the DNS challenge for my registrar, Namecheap. Unfortunately by the second or third challenge it would hang and eventually give up. I didn't have the problem splitting the subdomains into seperate certs and running them 5 minutes apa…

" … one of them needs to loosen up."

Or perhaps you need to revisit your decision to require "many subdomains" and consider whether it's a sensible decision if it relies on somebody else providing SSL certs for them inexpensively or for free.

You can buy a wildcard cert for under a hundred bucks these days - how much obligation do you think LetsEncrypt have to change their product to save you $100/year because of your design decisions? If LetsEncrypt (or Namecheap) don't work for you, pay someone who sells a thing that _does_ work for you (or change your requirements).

Re: Rate Limits

#103

Post by phil21 »

ajross wrote: post #88
Sephr wrote: post #62

Let's Encrypt doesn't support removing subdomains from a certificate like it supports adding subdomains, so people offering per-user subdomains need to create a completely new certificate every time a user deletes their account. All it takes is 5 (or 20?) users to delete their accounts and you've used up your Let's Encrypt quota for the entire week ! Without wildcard certificates or a method to remove subdomains from…

> LE is still useless for UGC sites with per-user subdomains Let's Encrypt is a public service , aimed at operators of individual systems who host web content or email in a casual sense, were poorly served by the complexity of getting and maintaining a TLS cert, and who empirically were basically not doing TLS. Your posited blog host is going to be a professional or semi-professional web admin. Just call up Comodo or…

I had a team member explain the project vastly differently to me. Can you provide a link that LE is only for personal/casual use?

As a webhost we have offered SSL certificates to customers for ages. Unless it's free you will see very little uptake. Which eliminates the main purpose for LE to exist, from what I was told.

I also have a rather compelling use case for far more than 20 subdomain certificates a week, but there is absolutely no "market" for that use-case - it simply increases Internet security. Which was the entire stated goal of the project, I thought.

First I've heard that LE is only for personal use :)

Re: Rate Limits

#104

Post by bigiain »

antar wrote: post #64

This is a ridiculously low limit for a SaaS provider.

Got any examples of SaaS providers who don't have low limits on their free tier offerings?

Personally I think you're badly mis-categorizing LetsEncrypt there - it's not like they're trying to bug you into signing up for a $29/month "Personal Plan" or a $199/month "Professional Plan" by keeping their limits low. They're giving their service away for free, and trying hard to only exclude the very edge cases of people who need way more resources to satisfy than the 99%.

If you've got a plan that requires hundreds of ssl certs per week to operate, and you don't have a revenue stream to pay for them, your plan needs more work. Just 'cause someone offers "free coffee", doesn't mean you can make a business out of showing up with a pickup truck full of 44gal drums and demand to have them fill you up for free so you can give it away to the customers at your restaurant...

Re: Rate Limits

#105

Post by antar »

bigiain wrote: post #104
antar wrote: post #64

This is a ridiculously low limit for a SaaS provider.

Got any examples of SaaS providers who don't have low limits on their free tier offerings? Personally I think you're badly mis-categorizing LetsEncrypt there - it's not like they're trying to bug you into signing up for a $29/month "Personal Plan" or a $199/month "Professional Plan" by keeping their limits low. They're giving their service away for free, and trying hard to only exclude the very edge cases of people w…

> Got any examples of SaaS providers who don't have low limits on their free tier offerings?

By SaaS I meant company offering subdomains/custom domains that needs LE - not LE itself. It's not a SaaS company to being with.

> They're giving their service away for free.

LE is not a charity. It's a business.

Re: Rate Limits

#106

Post by bigiain »

antar wrote: post #105
bigiain wrote: post #104

Earlier quoted context omitted.

Got any examples of SaaS providers who don't have low limits on their free tier offerings? Personally I think you're badly mis-categorizing LetsEncrypt there - it's not like they're trying to bug you into signing up for a $29/month "Personal Plan" or a $199/month "Professional Plan" by keeping their limits low. They're giving their service away for free, and trying hard to only exclude the very edge cases of people w…

> Got any examples of SaaS providers who don't have low limits on their free tier offerings? By SaaS I meant company offering subdomains/custom domains that needs LE - not LE itself. It's not a SaaS company to being with. > They're giving their service away for free. LE is not a charity. It's a business.

> By SaaS I meant company offering subdomains/custom domains that needs LE - not LE itself.

Ahhh, sorry, my misunderstanding. (But an alternative comment - it's not that those SaaS companies "need LE", it's just that they want free ssl certs. I _want_ free Tesla's - my local Tesla dealership doesn't care... That doesn't make their prices "ridiculously high", it a problem with my expectations.)

> LE is not a charity. It's a business.

Not sure I (or they) agree with you there:

"Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. Let’s Encrypt is a service provided by the Internet Security Research Group (ISRG)."

"Consider becoming a sponsor or simply donate via PayPal."

Sure there's a wide grey line between "a business", "a 501c non-profit", and "a charity" - but if your revenue stream comes from a "please donate or sponsor us" link, not your product's pricing (whether that's a thing/service you sell, or the privacy of your free users you're selling), I think you're a lot closer to the "charity" end of that line than the "business" end.

Re: Rate Limits

#107

Post by nickpsecurity »

j4cob wrote: post #29
bcoates wrote: post #27

I'll bite: sliding windows are a pain, if you hit them by accident they result in a weird self-DoS. Why not token bucket? It's a simpler algorithm to implement and less pain for the client. If I'm unaware of these limits and use them up all at once, I'm locked out for a week instead of having to wait 1/rate to issue just one more.

(Let's Encrypt engineer) Token bucket is a good idea, and I agree that it would make the user experience of hitting rate limits less onerous. We implemented sliding windows because they were straightforward to implement based on our long-term database state. I'll do some thinking about whether we can emulate a token bucket style on top of that without having to add another source of truth for rate limit information.

Has anyone published something about the performance, scaling, and price of your HSM's? I'd like a link to it if it's available.

Re: Rate Limits

#108

Post by icebraining »

Sephr wrote: post #65
pfg wrote: post #63

Earlier quoted context omitted.

A couple of points: 1. There is no way to remove a domain from an existing certificate. Changing a certificate in any way always results in a new issuance. That's just how certificates work, nothing specific to Let's Encrypt. Certificate issuance cannot be scaled to infinity, so the same limit has to apply here (otherwise anyone could just bypass the rate limit by adding and removing subdomains and launch a DoS that…

> 3. you might as well keep it around until your next renewal of that particular certificate and remove it at that point That does seem like the best workaround for now. Idealy in the future I hope we can synchronously make a LE API call on the spot instead of having to manually manage a revocation queue.

Why would you need a queue? At the trimonthly renewal time, just check which subdomains are active and ask only for those.

Re: Rate Limits

#109

Post by X-Istence »

phil21 wrote: post #103
ajross wrote: post #88

Earlier quoted context omitted.

> LE is still useless for UGC sites with per-user subdomains Let's Encrypt is a public service , aimed at operators of individual systems who host web content or email in a casual sense, were poorly served by the complexity of getting and maintaining a TLS cert, and who empirically were basically not doing TLS. Your posited blog host is going to be a professional or semi-professional web admin. Just call up Comodo or…

I had a team member explain the project vastly differently to me. Can you provide a link that LE is only for personal/casual use? As a webhost we have offered SSL certificates to customers for ages. Unless it's free you will see very little uptake. Which eliminates the main purpose for LE to exist, from what I was told. I also have a rather compelling use case for far more than 20 subdomain certificates a week, but t…

If you have per-user sub-domains, just get a wildcard cert, pay for it, and cover all your users all at once. Why do you need want to go through LE for that purpose?

Re: Rate Limits

#110

Post by sdoering »

dsr_ wrote: post #59
eximius wrote: post #50

For everyone that complains about Let's Encrypt, I just want to state that Let's Encrypt solves the single largest use case for issuing certificates for domains - a single server you control which hosts one (or more) website(s). All of these issues with 3 month certs, rate limiting, and limited certs/domain stem from much more complicated problems and it isn't fair to expect Let's Encrypt to tackle those.

And unless something really odd is happening, a small server owner will run into these problems when first setting up your LE certs for automated renewal and not any time thereafter.

That is something I do not see in my own (n=1) experience. The only problem I had was with a poorly written crontab entry, that was totally my fault.

Setting up my 5 domains, hosted on one small (virtual) server instance was just a breeze. Esp. compared to my former experience with StartSSL.

And now, with a cronjob doing auto renewal everything is solved. So for me at least Let's Encrypt just made life better.

Post reply on HN