Let's Encrypt: too many certificates already issued

What the message looks like

Error creating new order :: too many certificates (5) already issued for this exact set of identifiers in the last 168h0m0s, retry after 2026-10-25 14:02:11 UTC

Common causes

• More than 5 certificates for exactly the same set of names within 7 days.
• More than 50 new certificates per registered domain in 7 days, e.g. with many subdomains.
• A script or container requests a new certificate on every start because /etc/letsencrypt is not persistent.
• Testing against the production API instead of staging.
• Related: “too many failed authorizations” after several failed validations.

Check

1. Show locally available certificates
   certbot certificatesCopy
2. How often was it issued recently? Check the archive files
   ls -l /etc/letsencrypt/archive/example.com/Copy
3. View publicly issued certificates in CT logs
   curl -s 'https://crt.sh/?q=example.com&output=json' | jq -r '.[] | .not_before + " " + .name_value' | sort -r | head -n 20Copy
4. Find the exact error and retry-after in the certbot log
   grep -iE 'rateLimited|too many' /var/log/letsencrypt/letsencrypt.log | tail -n 5Copy

Fix

• Wait until the stated “retry after” – the limit cannot be reset by hand.
• Keep using the existing valid certificate instead of requesting a new one.
• In containers make /etc/letsencrypt a persistent volume.
• Run tests only with --dry-run or --staging.
• For many subdomains consider a wildcard certificate via DNS-01.

FAQ

Can I get around the limit by adding a name?

A different set of names is not covered by the exact-set limit, but still counts towards the per-domain limit. Better fix the cause of the loop.

Do renewals count?

Renewals of the same set count towards the duplicate-certificate limit. Normal renewal every 60 days never hits it – only loops do.