1

When I tried to add SSL to the hosting domain directly from letsencryt.org from the pre-built Plesk hosting cpanel I got the error as

SSL/TLS Certificates

Error: Could not issue a Let's Encrypt SSL/TLS certificate for xyz.example.net.
The "Certificates per Registered Domain" rate limit has been exceeded for xyz.example.net. Let's Encrypt allows no more than 20 certificates to be issued per registered domain, per week.
See the related Knowledge Base article for details.

Details

Invalid response from https://acme-v01.api.letsencrypt.org/acme/new-cert.

Details:

Type: urn:acme:error:rateLimited
Status: 429
Detail: Error creating new cert :: too many certificates already issued for: example.net: see https://letsencrypt.org/docs/rate-limits/

Neither of the domains nor the subdomains was encrypted?

In order to accomplish the same what I'm supposed to do?
OR
Manually Install Certbot from the Command Line Tool as shown below

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx
sudo certbot --nginx

Is it not possible to install from the web interface directly to the hosting domain so that all the DNS / Web spaces created from the same IP gets reflected. Is it possible right? If not otherwise are we suppose to create separate SSL for each domain/ web spaces?

From the advisor extension:

enter image description here

1

You have multiple questions in one.

Let's Encrypt Rate Limiting

For the rate limiting part it just means that you already asked Let's Encrypt too often for the same thing. When you say "When I tried to add SSL to the hosting domain" what did you do exactly?

As the error message says, you can not have more than 20 certificates to be issued per registered domain, per week. A warning here: if you do www.example.net and xxx.example.net the registered domain in both cases is example.net and hence you have now a count of 2 against this 50 limit

So I guess for whatever reason there may have been a loop somewhere or you have clicked too often on some button to request a certificate (sorry I know nothing about CPanel or this specific Let's Encrypt extension). Or did you request too many certificates for different names but below a single registered domain?

In any case you will now have to wait for a week, or start again your tests by using another domain name. Note that Let's Encrypt has also a "testing" interface, to learn and debug systems. This is documented here: https://letsencrypt.org/docs/staging-environment/ Maybe there is a way to plug your CPanel extension to it, so that you can test and better understand your system, after which you will be able to switch back to the production system.

Certbot

You can also install certbot on any host and work with it to generate certificates. Note that it solves only part of the problem, you still need to manage the renewals, configuring the webservers with the certificate, etc. (certbot can help but needs at least to be configured, same for the DNS or HTTP validation required for the certificate issuance).

Note that you will be governed by the exact same rate limiting rules as above, so if you are misusing certbot by requesting too "often" certificates for the same domain or registered domain you will get HTTP errors in the same way and no certificates issued.

Create separate SSL for each domain/ web spaces

All the last paragraph of your question is not clear at all so I will just try to give some hints.

First, please stop saying SSL. This protocol is 20 years old and has been replaced by TLS. And even in your case it is not really relevant anyway because you have a problem with certificates (more precisely X.509 certificates), not directly with TLS.

Now, the host where certbot (or equivalent) runs (to create and renew certificates), the website used for the HTTP validation, the nameserver used for the DNS validation and the final website using the certificates managed can technically be all separated on different boxes. But they can as well be all on the same server, for obvious better simplicity of management (but lower security probably). Of course you use either HTTP validation or DNS validation, not both.

As for certificates themselves, let us imagine you have www.example.com and www.example.net. You have various options:

  • either 2 separate certificates, one with www.example.com (and example.com added in the SAN list most probably), the other with www.example.net. It makes sense if domains are not registered at the same time or not managed the same way or by the same people
  • OR only one certificate having the 4 names (.com and .net, with and without the www.) in the SAN list and configuring both websites to use this single certificate.

The first case gives you probably more flexibility/security at the cost of having kind of double the maintenance. The second case can be a problem if you do not want your users to see they are "bundled" together (but they can discover it in other ways), and if you have more than 100 names anyway you hit Let's Encrypt Limit.

And you can not use a wildcard certificate in that case because the two domains are not under the same "root". You could have one if you wanted to secure both www.example.com and admin.example.com you could request a wildcard certificate for *.example.com instead of having to list each website name in the SAN part of the certificate.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.