You have multiple questions in one.
Let's Encrypt Rate Limiting
For the rate limiting part it just means that you already asked Let's Encrypt too often for the same thing.
When you say "When I tried to add SSL to the hosting domain" what did you do exactly?
As the error message says, you can not have more than 20 certificates to be issued per registered domain, per week. A warning here: if you do www.example.net and xxx.example.net the registered domain in both cases is example.net and hence you have now a count of 2 against this 50 limit
So I guess for whatever reason there may have been a loop somewhere or you have clicked too often on some button to request a certificate (sorry I know nothing about CPanel or this specific Let's Encrypt extension). Or did you request too many certificates for different names but below a single registered domain?
In any case you will now have to wait for a week, or start again your tests by using another domain name. Note that Let's Encrypt has also a "testing" interface, to learn and debug systems. This is documented here: https://letsencrypt.org/docs/staging-environment/
Maybe there is a way to plug your CPanel extension to it, so that you can test and better understand your system, after which you will be able to switch back to the production system.
Certbot
You can also install certbot on any host and work with it to generate certificates. Note that it solves only part of the problem, you still need to manage the renewals, configuring the webservers with the certificate, etc. (certbot can help but needs at least to be configured, same for the DNS or HTTP validation required for the certificate issuance).
Note that you will be governed by the exact same rate limiting rules as above, so if you are misusing certbot by requesting too "often" certificates for the same domain or registered domain you will get HTTP errors in the same way and no certificates issued.
Create separate SSL for each domain/ web spaces
All the last paragraph of your question is not clear at all so I will just try to give some hints.
First, please stop saying SSL. This protocol is 20 years old and has been replaced by TLS. And even in your case it is not really relevant anyway because you have a problem with certificates (more precisely X.509 certificates), not directly with TLS.
Now, the host where certbot (or equivalent) runs (to create and renew certificates), the website used for the HTTP validation, the nameserver used for the DNS validation and the final website using the certificates managed can technically be all separated on different boxes. But they can as well be all on the same server, for obvious better simplicity of management (but lower security probably). Of course you use either HTTP validation or DNS validation, not both.
As for certificates themselves, let us imagine you have www.example.com and www.example.net. You have various options:
- either 2 separate certificates, one with
www.example.com (and example.com added in the SAN list most probably), the other with www.example.net. It makes sense if domains are not registered at the same time or not managed the same way or by the same people
- OR only one certificate having the 4 names (
.com and .net, with and without the www.) in the SAN list and configuring both websites to use this single certificate.
The first case gives you probably more flexibility/security at the cost of having kind of double the maintenance. The second case can be a problem if you do not want your users to see they are "bundled" together (but they can discover it in other ways), and if you have more than 100 names anyway you hit Let's Encrypt Limit.
And you can not use a wildcard certificate in that case because the two domains are not under the same "root". You could have one if you wanted to secure both www.example.com and admin.example.com you could request a wildcard certificate for *.example.com instead of having to list each website name in the SAN part of the certificate.
