3 ms·
The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages
by teraflop 10y ago
The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages out to one certificate (which can include up to 100 hostnames) per roughly 8 hours, per domain.
That's probably good enough for almost everyone who uses hostnames to represent physical machines or services. But it's totally unusable if you want to create certificates on the fly in response to user signups.
[1]: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
- deleted 10y ago[deleted]
- foota 10y agoI'd imagine you might be able to reach out to them in that case.
- hawkice 10y agoI deploy all the different little code projects I make to different domains and I've hit the Let's Encrypt rate limit. If (like me) you waited a couple months to secure these little side projects, you'll hit the rate limit too. That being said, I just waited a week -- now everything is secure.
- mieko 10y agoThis is the real issue with not allowing wildcard certs. If the rate limits were something that just cut in at abuse-levels, there'd be no need for them. Sites with per-user subdomains (to get security features like cookie isolation, break same-origin effects, etc) run into the limits really quickly, and must currently rely on a wildcard. I've been calling this "the tumblr scenario", but people seem to think there's a way around it without just using another CA.