cert-manager / ACME "urn:ietf:params:acme:error:rateLimited" in CI
The ACME server (Let's Encrypt) refused the order with rateLimited because too many certificate requests came from the same account or domain set in a short window. In CI this is usually caused by pipelines that request real certificates on every run against the production ACME endpoint. The fix is to use the staging environment for tests and reserve production issuance for real deployments.
What this error means
cert-manager events or a certbot run report "urn:ietf:params:acme:error:rateLimited" and issuance stops. The order is rejected before validation.
Error creating new order: acme: urn:ietf:params:acme:error:rateLimited:
Error creating new order :: too many failed authorizations recentlyCommon causes
CI requests production certificates on every run
A pipeline that issues against the production ACME endpoint each build quickly exhausts the per-account or per-domain rate limits.
Repeated failed authorizations
Failing DNS-01 or HTTP-01 challenges over and over trips the failed-authorization limit, which then blocks new orders.
How to fix it
Use the ACME staging environment for tests
- Point the ClusterIssuer/certbot at the Let's Encrypt staging server for CI validation.
- Only issue from production for real deployments, not every pipeline run.
- Fix the underlying failing challenge before retrying, so you stop tripping the limit.
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directoryWait out the window and reduce request volume
Rate limits reset over time. Stop retrying in a tight loop, cache issued certificates, and only renew when needed.
How to prevent it
- Validate ACME flows against staging, never production, in CI.
- Cache and reuse issued certificates instead of reissuing per run.
- Fix failing challenges before retrying to avoid the failed-authorization limit.