Let's Encrypt issues free certificates at huge scale, so it enforces rate limits to keep the service fair and stable. Hitting a limit blocks new certificates for days, which can stall a launch or migration. This guide explains the main limits and how to stay well clear of them.
Before you start
The exact numbers change from time to time – always check the current values on Let's Encrypt's official rate limits page. The figures below are typical values at the time of writing.
The main limits
| Limit | Typical value | What it means |
|---|---|---|
| Certificates per registered domain | 50 per week | All certificates covering example.com and its subdomains combined |
| Duplicate certificates | 5 per week | Certificates for exactly the same set of names |
| Failed validations | 5 per hour per account, hostname | Repeated failures for the same name |
| Names per certificate | 100 | Maximum SANs on one certificate |
| New orders | Hundreds per account per few hours | Burst protection for big users |
Renewals of an existing certificate are treated more leniently in recent policies, but repeatedly re-issuing the same certificate still counts as duplicates.
How people hit limits
- Testing a broken setup in a loop with the production CA.
- Deleting
/etc/letsencryptor containers' volumes and re-issuing on every start. - Issuing a separate certificate per subdomain for hundreds of subdomains of one domain.
- Automation retrying aggressively after validation failures.
Use the staging environment for testing
- Certbot: add
--staging(or--test-cert). - acme.sh: add
--stagingor--server letsencrypt_test. - Traefik/others: point the ACME server URL to the staging directory.
Staging has much higher limits and issues untrusted test certificates. Switch to production only once validation works.
Strategies for many domains or subdomains
- Combine names – one certificate can cover up to 100 names.
- Use a wildcard –
*.example.comvia DNS-01 covers every subdomain with one certificate. - Persist certificate storage – keep
/etc/letsencryptor your ACME data on a volume that survives redeploys. - Back off on failure – automation should wait and alert rather than retry instantly.
- Spread across CAs – ACME clients can use other free CAs as a fallback.
If you've hit a limit
- The error message names the limit and when it resets.
- Use an existing valid certificate meanwhile, or a temporary certificate from another CA.
- Fix the cause before trying again.
On cPanel hosting, AutoSSL handles issuance and limits for you; this mostly concerns self-managed servers.
Check what's been issued
Search Certificate Transparency logs (for example crt.sh) for your domain to see every certificate issued recently and count how close you are to a limit.
FAQ: Let's Encrypt rate limits
Do renewals count toward the per-domain limit?
Let's Encrypt has adjusted policies so renewals are generally not blocked by the certificates-per-domain limit; check the current documentation.
Can I request a higher limit?
Large hosting providers can apply for adjustments via Let's Encrypt's request form.
Does the limit apply per server or per domain?
Mostly per registered domain and per account, regardless of how many servers you use.