Skip to main content
🎉 Enterprise for €149.50/year: pay for 10 months, get 12. That's €12.46/mo per server.Get 2 Months Free
OpenPanelDocumentation
Version: 2.0.11

Let's Encrypt Rate Limits and SSL Renewal Failures

OpenPanel issues and renews free Let's Encrypt certificates automatically. Most of the time you never have to think about it - but when a certificate fails to issue or renew, the cause is almost always one of the few problems below.

How Issuance and Renewal Work​

  • A certificate is requested the first time a domain is opened over https://, for the domain and its www.
  • Let's Encrypt checks that the domain really points to your server (an HTTP challenge on port 80, or a TLS challenge on port 443).
  • Certificates are valid for a short period and are renewed automatically well before they expire.
  • If issuance fails, it's retried automatically with increasing delays, so a temporary problem fixes itself once the cause is gone.

To see what's happening for a domain, administrators can run:

opencli domains-ssl example.com status   # AutoSSL, Custom SSL or no SSL
opencli domains-ssl example.com info     # certificate details and expiry
opencli domains-ssl example.com logs     # recent issuance/renewal log lines

Let's Encrypt Rate Limits​

Let's Encrypt limits how many certificates can be requested, to protect its service. The limits you're most likely to hit:

LimitValueTypical cause
Failed validations5 per hostname, per hourDNS not pointing to the server yet, port 80/443 blocked
Duplicate certificates5 per exact set of names, per weekReinstalling the server or deleting and re-adding the same domain many times
Certificates per registered domain50 per week (e.g. for example.com and all its subdomains)Adding many subdomains of one domain at once
New orders300 per account, per 3 hoursMigrating hundreds of domains at once

See the current values in the Let's Encrypt documentation.

What to do when you hit a limit​

  • Wait. Limits reset on a rolling window - an hour for failed validations, a week for duplicate certificates.
  • Fix the cause first, so the next automatic retry succeeds (see below). Repeatedly clicking Generate now while DNS is still wrong only adds more failed validations.
  • Don't reinstall or delete domains to "reset" SSL - that uses up the duplicate-certificate limit.
  • Migrating many domains? Move DNS in batches, so certificates are requested gradually.

OpenPanel's proxy (Caddy) also falls back to another free certificate authority when Let's Encrypt is unavailable or rate-limited, so most sites still get a valid certificate.

Common Reasons Issuance or Renewal Fails​

1. DNS doesn't point to the server​

The domain's A record (and www) must point to the server's IPv4 address, and DNS must be fully propagated.

dig +short example.com
dig +short www.example.com

Both should return your server IP. Check globally with whatsmydns.net. If only www is missing, the certificate for www fails - add the record. See Troubleshooting DNS.

2. An AAAA (IPv6) record points somewhere else​

Let's Encrypt prefers IPv6. If the domain has an AAAA record for an old server or an IPv6 address that isn't configured on this server, validation fails. Remove the wrong AAAA record, or make sure it points to this server.

3. Ports 80 or 443 are blocked​

Validation needs incoming connections on port 80 and 443. Check any firewall in front of the server (cloud security groups, Hetzner/OVH/Oracle firewalls) as well as Sentinel Firewall.

4. Cloudflare proxy​

With Cloudflare's orange cloud on, Cloudflare answers the validation requests. Use Full (strict) SSL mode, or temporarily switch the record to DNS only while the first certificate is issued - see Use Cloudflare with OpenPanel.

5. A CAA record blocks Let's Encrypt​

A CAA DNS record lists which authorities may issue certificates for the domain. If it exists and doesn't include Let's Encrypt, issuance is refused:

dig +short CAA example.com

Add 0 issue "letsencrypt.org" to the domain's CAA records, or remove the CAA record.

6. A redirect or the WAF interferes​

A redirect from the domain to another site, or a strict web application firewall rule, can block the validation request under /.well-known/acme-challenge/. Temporarily remove the redirect and try again - see 403 errors.

7. The domain isn't in OpenPanel​

Certificates are issued only for domains added on the Domains page (and their www). Other hostnames pointing to the server - for example test.example.com when only example.com is added - don't get a certificate. Add them as domains.

Force a New Attempt​

Once the cause is fixed:

  1. Go to OpenPanel → Domains → SSL for the domain.
  2. Click Generate now (or Switch to Let's Encrypt and generate if it was using a custom certificate).
  3. Open https://example.com in a browser.

If it still fails, check the logs with opencli domains-ssl example.com logs and see the SSL troubleshooting guide.

Previous
Install a Custom / Paid SSL Certificate
Next
404 Error Troubleshooting Guide
Was this helpful?