Let's Encrypt Rate Limited? Fix 'Too Many Certificates'
You run certbot renew and instead of a fresh certificate you get a wall of red text: "too many certificates already issued." No typo in your config, no expired DNS token — just Let's Encrypt telling you to come back later. Here's what actually triggers this, how to read the specific limit you hit, and how to get certificates issuing again without making it worse.
Symptom
Certbot (or your ACME client, or cPanel's AutoSSL) fails with an error that mentions one of these phrases:
too many certificates already issued for this exact set of domainstoo many certificates (5) already issued for this exact set of identifiers in the last 168 hourstoo many new orders recentlytoo many failed authorizations recently
Retrying immediately doesn't help — you get the same error, sometimes with a slightly different wait time attached. Meanwhile your site is either running on an expired cert or, if this is a first issuance, has no cert at all and browsers are throwing SSL warnings.
Why This Happens
Let's Encrypt rate-limits per registered domain (your domain plus everything under it, e.g. example.com covers www.example.com and shop.example.com too) to stop the free CA from being hammered by broken automation. The limits that actually bite hosting customers:
| Limit | Threshold | Window |
|---|---|---|
| Certificates per Registered Domain | 50 | rolling 7 days |
| Duplicate Certificate (identical hostname set) | 5 | rolling 7 days |
| Failed Validations per Account/Hostname | 5 | 1 hour |
| New Orders per Account | 300 | 3 hours |
| Accounts per IP Address | 10 | 3 hours |
In practice, three situations cause almost every rate-limit ticket we see:
1. A cron job or deploy script retries on every failure
If your renewal hook fails for an unrelated reason — a firewall blocking HTTP-01 validation, a stale DNS token for DNS-01 — and the automation just re-runs certbot every few minutes "to be safe," you burn through the 5 duplicate-certificate limit in under half an hour. The original problem never gets fixed because every attempt fails the same way, and now you're also rate-limited on top of it.
2. Adding and removing SAN entries repeatedly
Each unique combination of hostnames on a certificate counts as a "duplicate" of itself. If you're testing a multi-domain cert and keep adding one subdomain, reissuing, removing it, reissuing again, each combination change resets what counts as a "duplicate," but you're still consuming certificates against the 50-per-week Registered Domain cap. Five or six rounds of trial and error and you're out of headroom for the week.
3. Wildcard renewal failing silently, then being force-retried
Wildcard certs need DNS-01 validation. If the DNS API plugin (certbot-dns-cloudflare, certbot-dns-route53) has a revoked token, every renewal attempt fails authorization. Five failed authorizations for the same hostname in an hour trips the failed-authorization limit specifically, which is separate from — and usually hits before — the certificate-issuance limits above.
The Fix
Step 1: Read the exact error text
The message tells you which limit you tripped and, in most cases, a rough reset time. Run:
certbot certificates
certbot renew --dry-runThe --dry-run flag hits Let's Encrypt's staging environment, which has its own, far more generous limits and doesn't count against your production quota at all. Use it to confirm your actual problem (firewall, DNS token, permissions) is fixed before you burn another production attempt.
Step 2: Fix the underlying validation failure first
Don't just wait out the clock and retry the same broken config — you'll be back here next week. Common root causes to check while you wait:
- HTTP-01 validation: confirm port 80 is open and
/.well-known/acme-challenge/isn't blocked by a firewall rule, a redirect-to-HTTPS rule that fires before validation, or ModSecurity. - DNS-01 validation: verify the API token for your DNS plugin hasn't expired or been revoked, and that the TXT record actually propagates before Let's Encrypt checks it (test with
dig TXT _acme-challenge.yourdomain.com). - cPanel AutoSSL: check WHM → SSL/TLS Status for the specific domain-validation error, not just "AutoSSL failed" — it usually names the exact DCV method that's failing.
Step 3: Wait out the window — don't force it
Rate limits reset on a rolling basis, not a fixed clock. If you hit the 5-duplicate-certificate limit at 2:00 PM on Monday, the oldest of those five attempts "expires" from the count 168 hours later, not at midnight or on any fixed schedule. There's no support ticket that gets Let's Encrypt limits lifted early for a standard hosting account — the only real lever is fixing the cause and letting the window roll forward.
Step 4: Reduce how many certificates you actually need
If you're requesting separate certificates for example.com, www.example.com, and three more subdomains individually, each one counts toward the 50-per-week Registered Domain limit. Consolidate into a single SAN certificate covering all the hostnames in one request, or use a wildcard (*.example.com) if the subdomain list changes often. One certificate covering ten names uses one slot against the limit; ten separate certificates use ten.
Prevention
- Always test with
certbot renew --dry-runor the--stagingflag before troubleshooting live, especially after changing DNS plugins, firewall rules, or moving a site. - Set renewal cron jobs to run once, not in a retry loop. Certbot's own systemd timer / cron entry already retries twice daily — a homemade wrapper that reruns on every non-zero exit code is what causes most rate-limit incidents.
- Consolidate hostnames onto SAN or wildcard certificates instead of issuing one cert per subdomain.
- Monitor certificate expiry separately from renewal success, so a silently failing renewal doesn't go unnoticed until the cert actually expires and you're troubleshooting under pressure.
- Keep DNS API tokens for
certbot-dns-*plugins in a place you'll remember to rotate before they expire, not just at initial setup.
Frequently asked questions
How long until I can request a certificate again?
Rate limits reset on a rolling 7-day (or 1-hour, for failed authorizations) window from each individual attempt, not on a fixed daily reset. If you stop retrying now, the oldest attempts age out of the count over the next several days and you'll gradually regain headroom.
Can I ask Let's Encrypt or Getwebup support to lift the rate limit?
Let's Encrypt does not grant manual rate-limit exceptions for standard hosting use cases — the limits are enforced automatically and reset on their own schedule. The fix is almost always to stop retrying, resolve the validation failure, and let the window pass.
Does testing with --dry-run count against my limit?
No. certbot renew --dry-run and the --staging flag use Let's Encrypt's separate staging environment, which has much higher limits and issues certificates browsers won't trust. Use it freely to confirm a fix works before attempting a real issuance.
Will a wildcard certificate help me avoid this in the future?
Often, yes. A wildcard covers every subdomain under one hostname with a single certificate, so adding or renaming subdomains doesn't consume a new slot against your 50-per-week Registered Domain limit the way individual per-subdomain certificates do.
I'm on cPanel AutoSSL — does the same limit apply?
Yes. AutoSSL uses the same Let's Encrypt (or Sectigo, depending on your provider setting) issuance backend, so repeated AutoSSL failures and automatic retries can trip the same rate limits. Check WHM → SSL/TLS Status for the specific domain-validation error before letting AutoSSL retry again.