Traefik Let's Encrypt ratelimit

Traefik Traefik v2
1

Hi all,

I'm obviously new to Traefik and don't understand how the certificate renewal process works because I now have 10 domains unreachable to the outside world :frowning:

Error creating new order :: too many certificates already issued for exact set of domains:

I've got Traefik and a couple of containers setup, all working properly for a couple of days. Today though I tested some infrastructure as code with Terraform and Ansible so wiped the VPS a couple of times and the restarted the docker-compose setups a couple of times. I've kept the acme.json all this time but apparently this is useless for the actual workings of Let's Encrypt? Because now I'm hitting the rate limit while the acme.json is still in tact.

Why is it constantly requesting new certs and/or how can I reuse the old ones?

Any help greatly appreciated!

PS. I've read the ratelimit docs in the mean time and know now I had to use the staging servers instead, but I would like to know what the best way forward is with my 10 domains not being down. How can I reuse old certs? How is the acme.json file useful? Etc.

2

Could somebody please be so kind to explain to me how this works because I've locked all my domains out again for the second week in a row.

  1. Why will it for every docker-compose restart try to fetch new certificates although the acme.json is unchanged and in a (persistent) directory on the host?
  2. Why will it also demolish all already running sites when it cannot renew because of this rate limit?
3

I don't know if this is the issue you had, but I had this problem with ACME DNS service when ACME_DNS_STORAGE_PATH was set correctly in the container environment variables but the same path was not set in the config file under certificateResolvers:name:acme:storage.

With this half-set configuration, it seems the acmedns.json file is created with the auth details for ACME DNS, but no certificates were ever stored in it (file size less than 1KB). On each restart, Traefik reuses the ACME DNS service credentials but it has to request all of the certificates again.

Once the storage: key was set correctly, the certificate details are also stored in acmedns.json (file size now well over 10KB) and the certificates can be reused on restart.