Let's Encrypt certificate rate limits

Let's Encrypt issues certificates to anyone, and because it does, it has to rate limit requests so one bad script cannot overwhelm the service. People run into these limits when they batch-create many sites, point a tool at too many domains at once, or keep re-issuing for the same host list to fix a workflow. Understanding the limits turns a frustrating cascade of "too many certificates" errors into a solvable configuration problem.

The main limits

Two limits matter most in practice. The headline number is 50 new certificates per registered domain per 7 days. A registered domain is the eTLD+1, so for both www.example.com and api.example.com the bucket belongs to example.com. This is a global limit; every account and every machine requesting for that domain shares the same count. The bucket refills at one certificate about every 202 minutes. Because the limit counts successful issuance, waiting and retyping the request works, but hammering repeatedly makes it worse.

There is also a duplicate certificate limit of 5 per week for the exact same set of hostnames. Cease-and-desist by bundling the same list over and over, for instance to test a config, hits this even when the domain bucket is not full. New orders in general are limited per account to hundreds over a short window, so a misbehaving client that opens thousands of orders per hour gets throttled.

What renewal is exempt

Renewals do not count against the 50-per-domain limit. A renewal is re-issuing an existing certificate for the same set of hostnames with the same key within its window. This matters as certificate lifetimes shorten and renewal frequency rises: renewing is effectively free of the domain bucket. The main renewal-adjacent cap is the duplicate-set limit, which still applies if you repeatedly pull the same certificate without actually meaning to renew it.

Staying under them

The discipline is to not issue more than you need. Automation should reuse one certificate per domain, renew in place, and never re-issue on every job run. If a configuration trial genuinely needs many certificates for the same hostname list, wait past the refill window instead of re-issuing in a loop. Spread genuinely different domains across their own buckets naturally, since each registered domain has its own allowance.

Requesting an override

When a legitimate operation, such as a large migration bringing many domains under ACME at once, is blocked, Let's Encrypt can grant a rate-limit override on request. Overrides are available for the new-certificates-per-registered-domain and the new-orders-per-account limits, and are granted on a temporary basis for specific domains. They are process-driven and take time, so they are for planned bursts, not for an urgent fix. Authorization failures and the duplicate-set limit are not overridable.

Related certificate flow

Rate limits sit one step before the certificate reaches your server. The ACME client guide covers the tooling that issues and renews, and the renewal checklist covers what to verify after issuance so you do not churn the CA with repeated corrections.