Let's Encrypt Rate Limits Explained for Forum Administrators
Securing a community platform with HTTPS is an essential technical step, whether you are preparing your stack to meet modern forum software server requirements or deploying subdomains for your helpdesk, chat, and community boards. Let's Encrypt relies on an automated token bucket system to balance traffic, meaning capacity refills gradually over time rather than resetting instantly. Understanding the exact figures in the Rate Limits - Let's Encrypt documentation prevents unexpected lockouts when reinstalling servers, testing automation, or rolling out multiple forum hostnames.
5 per 7 Days: Identical Certificate Sets
One of the most frequent traps for forum admins during maintenance is the limit on duplicate issuance. Let's Encrypt allows up to 5 certificates to be issued for the exact same set of identifiers every 7 days. This rule applies globally across all accounts requesting that exact combination of names or IP addresses.
Admin teams often encounter this threshold when reinstalling an ACME client repeatedly to troubleshoot server errors, or when wiping configuration files during automated deployments. Capacity for this limit refills at a rate of 1 certificate every 34 hours. No administrative overrides are offered for this rule. If you run into this restriction, the documented workaround is to modify the set of identifiers—such as adding another subdomain like blog.example.com—to request a fresh certificate, though that request remains subject to domain-level limits.
50 per 7 Days: The Registered Domain Threshold
If your community spans several sections on separate subdomains—such as separate hostnames for different forum topics, user portals, or staff boards—you must track the domain-level ceiling. Let's Encrypt allows up to 50 certificates per registered domain (or single IPv4 address, or IPv6 /64 range) every 7 days.
The system determines your registered domain using the Public Suffix List. For instance, in www.example.com or forum.example.com, example.com is the registered domain. This 50-certificate limit is shared globally by all accounts issuing certificates under that registered domain. It refills at a pace of 1 certificate every 202 minutes. If a large project outgrows this threshold, administrators can apply for an override using the Let's Encrypt rate limiting form, though processing takes a few weeks.
5 Failures per Hour: Hourly Validation Blocks
When you are adjusting web server virtual hosts, firewalls, or domain records to harden forum admin security, validation errors can quickly accumulate. Let's Encrypt restricts accounts to 5 authorization failures per identifier every hour.
Once you hit 5 failed attempts on an identifier, the system halts new orders for that identifier from your account until your allowance recovers. The allowance refills at 1 failure per identifier every 12 minutes. Let's Encrypt notes that failures with HTTP-01 or TLS-ALPN-01 commonly occur because firewall rules or network settings block incoming validation traffic, while DNS-01 errors often stem from typos or missed steps when configuring validation records. To avoid burning through production limits during setup, switch your client to the staging environment.
1,152 Consecutive Failures: Account Pauses and the Portal
To keep automated systems from endlessly retrying broken configurations, Let's Encrypt enforces a long-term consecutive failure cap. An account can accumulate up to 1,152 consecutive authorization failures per identifier before issuance is paused for that name.
This allowance refills at 1 per identifier every day, and the count drops back to zero whenever an authorization for that identifier succeeds. If issuance gets paused, the error response provides a link to a Self-Service Portal. Through this portal, you can unpause issuance for the affected identifier and up to 49,999 additional paused identifiers tied to your account. The time it takes to reach a pause depends on retry frequency:
- 1 failure per day: Never paused.
- 2 failures per day: Paused after 1,152 days (3.16 years).
- 5 failures per day: Paused after 288 days (9.46 months).
- 10 failures per day: Paused after 128 days (4.21 months).
- 15 failures per day: Paused after 82 days (2.70 months).
- 20 failures per day: Paused after 61 days (1.99 months).
- 30 failures per day: Paused after 40 days.
- 40 failures per day: Paused after 30 days.
- 120 failures per day: Paused after 10 days.
300 Orders and 100 Identifiers: Account-Level Volume
For community networks deploying individual certificates for distinct services, order ceilings ensure stable infrastructure. A single Let's Encrypt account can create up to 300 new orders every 3 hours, recovering at a speed of 1 order every 36 seconds. Overrides for this specific ceiling can be requested for individual accounts.
In addition, a single certificate can include up to 100 identifiers (domain names or IP addresses). For registration endpoints, Let's Encrypt restricts new accounts to 10 per single IP address every 3 hours (refilling at 1 every 18 minutes) and 500 accounts per /48 IPv6 subnet every 3 hours (refilling at 1 every 22 seconds), neither of which permits overrides.
Finally, as detailed in the Rate Limits - Let's Encrypt documentation, certificate renewals handled via ACME Renewal Info (ARI) enjoy complete exemption from all rate limits when executed within their recommended renewal window. Revoking an existing certificate will never reset your consumed rate limit counters, because issuance resources have already been spent.
Sources
Published October 28, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.