GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing letsencrypt.org — Rate Limits Rate Limits
Last updated: August 5, 2026
See all Documentation Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. We believe these rate limits are high enough to work for most people by default. We’ve also designed them so that renewing a certificate almost never hits a rate limit, and so that large organizations can gradually increase the number of certificates they can issue without requiring intervention from Let’s Encrypt. If you’re actively developing or testing a Let’s Encrypt client, please utilize our staging environment instead of the production API. If you’re working on integrating Let’s Encrypt as a provider or with a large website please review our Integration Guide. How Our Rate Limits WorkLimits are calculated, per request, using a token bucket algorithm. This approach provides flexibility in how you use your allotted requests. You can either make requests in bursts—up to the full limit—or space out your requests to avoid the risk of being limited. If you’ve hit a rate limit, we don’t have a way to temporarily reset it. Don’t worry, your capacity for that limit will gradually refill over time, allowing you to make more requests without any additional action on your part. Revoking certificates does not reset rate limits, because the resources used to issue those certificates have already been consumed. For more information please see Retrying After Hitting Rate Limits. Account Registration LimitsThe following limits apply when subscribers request a new account using the new-account API endpoint. Exceeding these limits is very rare. We recommend that large integrators prefer a design which uses one account for many customers. New Registrations per IP AddressUp to 10 accounts can be created from a single IP address every 3 hours. The ability to create new accounts refills at a rate of 1 account every 18 minutes. OverridesWe do not offer overrides for this limit. New Registrations per IPv6 RangeUp to 500 accounts can be created from a single /48 IPv6 subnet every 3 hours. The ability to create new accounts refills at a rate of 1 account every 22 seconds. OverridesWe do not offer overrides for this limit. Certificate Issuance LimitsThe following limits apply when subscribers request a new certificate using the
New Orders per AccountEach time you request a certificate from Let’s Encrypt, a new order is created. A single certificate can include up to 100 identifiers (DNS names or IP addresses) depending on the certificate profile selected. For performance reasons, it’s better to use fewer identifiers per certificate whenever you can. LimitUp to 300 new orders can be created by a single account every 3 hours. The ability to create new orders refills at a rate of 1 order every 36 seconds. OverridesTo exceed this limit, you must request an override for a specific account. New Certificates per Registered DomainA registered domain is, generally speaking, the part of the domain you purchased
from your domain name registrar. For instance, in If you’re requesting a certificate for an IP address, we also try to treat the most common allocation (what you’d get from your ISP or hosting provider) as the “registered domain.” For IPv4 addresses, we treat the exact address as the registered domain. For IPv6 addresses, we treat the containing /64 range as the registered domain. You can get a list of certificates issued for your registered domain by searching crt.sh or Censys, which use the public Certificate Transparency logs. LimitUp to 50 certificates can be issued per registered domain (or IPv4 address, or IPv6 /64 range) every 7 days. This is a global limit, and all new order requests, regardless of which account submits them, count towards this limit. The ability to issue new certificates for the same registered domain refills at a rate of 1 certificate every 202 minutes. OverridesTo exceed this limit, you must request an override for the specific registered domain or an account. New Certificates per Exact Set of IdentifiersIf you request a certificate for LimitUp to 5 certificates can be issued per exact same set of identifiers every 7 days. This is a global limit, and all new order requests, regardless of which account submits them, count towards this limit. The ability to request new certificates for the same exact set of identifiers refills at a rate of 1 certificate every 34 hours. Common CausesReinstalling your client multiple times to troubleshoot an unknown error, or deleting your ACME client’s configuration data each time you deploy your application, are common ways to hit this limit. We have intentionally set this limit relatively low to prevent buggy systems or software under development from rapidly consuming the capacity of other rate limits. When testing or troubleshooting your applications, we recommend configuring your client to use our staging environment, which has significantly higher limits. WorkaroundIf you’ve hit this limit, you can change the set of identifiers by adding
OverridesWe do not offer overrides for this limit. Authorization Failures per Identifier per AccountAn authorization is generated for each identifier (DNS name or IP address) included in an order. Before a certificate can be issued, all authorizations in the order must be successfully validated. A failed authorization means that, although the requests for validation were sent successfully, all of Let’s Encrypt’s attempts to validate control of the identifier have failed. LimitUp to 5 authorization failures per identifier can be incurred by one account every hour. The ability to incur authorization failures refills at a rate of 1 per identifier every 12 minutes. Once exceeded, this limit is enforced by preventing any new orders for the same identifier, by the same account until the limit resets. Common CausesBefore you begin troubleshooting, we recommend you set your client to use our staging environment. This environment has significantly higher limits, which can help you identify and resolve issues without consuming your production limits.
OverridesWe do not offer overrides for this limit. Consecutive Authorization Failures per Identifier per AccountSimilar to Authorization Failures per Identifier per Account but only applies to consecutive failures. This limit is designed to prevent clients from getting stuck forever in a loop of failed validations. LimitUp to 1,152 consecutive authorization failures per identifier can be incurred by one account. The ability to incur authorization failures refills at a rate of 1 per identifier every day and resets to zero if an authorization for that identifier is successfully validated. Once exceeded, the account is prevented from requesting new certificates for that identifier. Each time the subscriber attempts to request a certificate they will receive an error containing a link to our Self-Service Portal where they can unpause issuance for the paused identifier and up to 49,999 additional paused identifiers associated with their account.
Common CausesBefore you begin troubleshooting, we recommend you set your client to use our staging environment. This environment has significantly higher limits, which can help you identify and resolve issues without consuming your production limits.
OverridesWe do not offer overrides for this limit. Overall Requests LimitIn addition to our account registration and certificate issuance limits, there are per-endpoint overall request limits that apply per-IP address. These are enforced by our load balancers and are designed to protect the ACME API from being overwhelmed by clients that make too many requests at once.
Subscribers who exceed these limits will receive a Limit Exemptions for RenewalsLet’s Encrypt recognizes a new certificate order as a “renewal” in two ways: the preferred method is through ACME Renewal Info (ARI), which is exempt from all rate limits, and the other relies on older renewal detection logic that considers orders with the exact same set of identifiers as renewals but may still be subject to certain rate limits. ARI RenewalsRenewals coordinated by ARI offer the unique benefit of being exempt from all rate limits. Clients that support ARI periodically check with Let’s Encrypt servers to determine if your existing certificate should be renewed. When the optimal renewal window is reached the client requests a new order explicitly indicating the certificate it replaces. If the new order includes at least one identifier matching the certificate it intends to replace and the certificate has not been previously replaced using ARI, the order will not be subject to any rate limits. Non-ARI RenewalsIf your client or hosting provider has yet to add support for ARI, your order
can still be considered a renewal of an earlier certificate if it contains the
exact same set of identifiers, ignoring capitalization and the order of
identifiers. For example, if you requested a certificate for the identifiers
Retrying After Hitting Rate LimitsAll of our rate limit error messages follow the same format. For example: You should be able to successfully make the same request after the provided date and time. If your request exceeds the capacity of more than one of our limits, we will always return the error message for the limit that resets furthest in the future. Retry-After HeaderWe include a Requesting an OverrideIf you are a large hosting provider or organization working on a Let’s Encrypt integration, we have a rate limiting form that can be used to request higher rate limits. It takes a few weeks to process requests, so this form is not suitable if you just need to reset a rate limit faster than it resets on its own. | ||||||||||||||||||||||||||||||||||||||||||||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |