letsencrypt / letsencrypt/boulder
Non-ARI renewals for IPv6 Identifier not limited to every 34H
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Poster at community thread. Recap at this post: https://community.letsencrypt.org/t/are-shortlived-certs-have-higher-rate-limit/245651/11
They are able to issue a cert every 24H using the shortlived profile containing only an IPv6 address Identifier
They ran a test request in rapid succession and got rejected after 5 issued, as expected. But, every 24H is allowed. The LE Rate Limit docs say this should be allowed at most every 34H.
The cert history shows the times are nearly the same from day to day. There is no extra 8H skew and no missing dates.
Cert history at: https://crt.sh/?q=2A0E%3A97C0%3A3F0%3A1%3A0%3A0%3A0%3A2573&deduplicate=Y
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked community recap and the certificate history to verify the reported 24-hour renewal pattern against the documented 34-hour limit. Trace the IPv6-only shortlived-profile issuance and rate-limit handling in Boulder, then add or run a regression test showing that non-ARI renewals are limited as documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100