auto-ssl / auto-ssl/lua-resty-auto-ssl

ACME v2 rate limit: too many new orders recently

Open
#213 1 comment 5 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

We have updated to current head (9d43c23af16203b5f94b270fde4b33a77b9cabde), plus a couple of patches, for our production servers, but had to revert after a bit more than two weeks, because certificates for newly added domains weren't getting issued.

The cause for this seems to be this rate limit:

```
{
"type": "urn:ietf:params:acme:error:rateLimited",
"detail": "Error creating new order :: too many new orders recently: see https://letsencrypt.org/docs/rate-limits/",
"status": 429
}
```

which seems to be new to ACME v2. As per [documentation](https://letsencrypt.org/docs/rate-limits/):

> For users of the ACME v2 API you can create a maximum of 300 New Orders per account per 3 hours.

We're certainly not generating that many certificates organically, however, it appears to me that renewals are also counting as an "order". Is anyone able to confirm?

I am thinking this is the case because of the following I pulled from the log. If this is the case - how are renewals for systems with many thousands of domains going to work, if only the first three hundred (renewals) can be handled, and the rest not only fails - but the system is also unable to issue certificates for new organic domains.

This seems like a major issue. I'd appreciate any comment - wasn't following the specifics about ACME v2 too closely (e.g. if it is still possible to make lua-resty-auto-ssl use the v1 API for the time being?). Thanks.

```
+ Checking domain name(s) of existing cert... unchanged.
+ Checking expire date of existing cert...
+ Valid till Jan 18 11:08:23 2020 GMT Certificate will expire
(Less than 30 days). Renewing!
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
err: + ERROR: An error occurred while sending post-request to https://acme-v02.api.letsencrypt.org/acme/new-order (Status 429)

Details:
HTTP/2 429
server: nginx
date: Sat, 28 Dec 2019 05:20:40 GMT
content-type: application/problem+json
content-length: 190
boulder-requester: 73071685
cache-control: public, max-age=0, no-cache
link: ;rel="index"
replay-nonce: 0101Y6s7Fje84XcfGYCVjicPF2XTpFp6Asu6zch1BqnDvFk

{
"type": "urn:ietf:params:acme:error:rateLimited",
"detail": "Error creating new order :: too many new orders recently: see https://letsencrypt.org/docs/rate-limits/",
"status": 429
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

No source file, test, or concrete code change is named. Start by tracing how renewal requests reach the ACME v2 /new-order endpoint and compare that behavior with the reported 429 log; done requires confirming the renewal rate-limit behavior and defining an actionable fix for affected deployments.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.