Skip to content

Non-ARI renewals for IPv6 Identifier not limited to every 34H #8657

@githubRover

Description

@githubRover

Poster at community thread. Recap at this post: https://community.letsencrypt.org/t/are-shortlived-certs-have-higher-rate-limit/245651/11

They are able to issue a cert every 24H using the shortlived profile containing only an IPv6 address Identifier

They ran a test request in rapid succession and got rejected after 5 issued, as expected. But, every 24H is allowed. The LE Rate Limit docs say this should be allowed at most every 34H.

The cert history shows the times are nearly the same from day to day. There is no extra 8H skew and no missing dates.

Cert history at: https://crt.sh/?q=2A0E%3A97C0%3A3F0%3A1%3A0%3A0%3A0%3A2573&deduplicate=Y

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions