3.8 CA Rate Limits

Most certificate authorities limit how fast they’ll issue certificates. Routine renewals rarely come close, and Let’s Encrypt exempts ARI renewals from all of its limits. The limits matter when you issue a lot of new certificates at once, like onboarding a large environment or moving every certificate to a new CA after a distrust. A certificate moving from another CA is new to the CA it moves to, so renewal exemptions don’t apply.

Every limit has a scope. Some count per ACME account, some per Google Cloud project, and some per registered domain across every account. The scope decides how to get around it.

Limits by CA

Only Let’s Encrypt, Google Trust Services, and AWS publish numeric ACME rate limits. ZeroSSL and SSL.com say they have none. The rest publish no ACME rate limits, and what you’ve bought from them usually decides how much you can issue.

CA	What limits a large migration	Scope	Can it be raised?
Let’s Encrypt	50 new certificates per registered domain per 7 days. 300 new orders per account per 3 hours	Registered domain, across all accounts. ACME account	Yes, with an override request that takes a few weeks
Google Trust Services	100 new orders per hour	Google Cloud project, shared by every ACME account in it	Not documented. Use more projects
AWS Certificate Manager	Finalize requests per second. AWS’s two quota pages say 1 and 50	AWS account and Region	Yes, in Service Quotas
ZeroSSL	No published limit	None published	Not applicable
SSL.com	No issuance rate limit. Each certificate is billed	SSL.com account	Buy more certificates
Actalis	No published limit. Single-name DV is unlimited on every plan, and multi-name certificates count against your plan	Actalis account	Change plans
DigiCert	No published limit. The order you bought	DigiCert account	Buy more
GlobalSign	No published limit. Your SAN license or product pack	GlobalSign Atlas account	Accept a new quote or reorder
GoDaddy	No published limit. One EAB credential per purchased certificate	Purchased certificate	Buy more certificates
Sectigo	No published limit. The order you bought	Sectigo account	Buy more

Let’s Encrypt rate limits

Let’s Encrypt’s limits refill gradually. Once you use up a limit, capacity comes back one unit at a time at the refill rate.

Limit	Default	Scope	Override?
New certificates per registered domain	50 per 7 days, refills 1 every 202 minutes	Registered domain, across all accounts	Yes
New orders per account	300 per 3 hours, refills 1 every 36 seconds	ACME account	Yes
New certificates per exact set of names	5 per 7 days, refills 1 every 34 hours	The exact set of names, across all accounts	No
Authorization failures per name	5 per hour, refills 1 every 12 minutes	Name and account	No
Consecutive authorization failures per name	1,152, refills 1 per day, resets on a successful validation	Name and account	No. Unpause the name in Let’s Encrypt’s Self-Service Portal
New accounts per IPv4 address	10 per 3 hours, refills 1 every 18 minutes	IP address	No
New accounts per IPv6 range	500 per 3 hours, refills 1 every 22 seconds	/48 range	No

ARI renewals are exempt from every limit. A renewal without ARI for the same set of names is exempt from the per-domain and per-account limits.

When one registered domain needs more than 50 new certificates, the per-domain limit stops a migration first. After the first 50, the domain gets about seven more a day. When every domain needs 50 or fewer, the account’s 300 orders per 3 hours is the limit instead. The per-domain limit counts across every account, so splitting accounts doesn’t help with it. Only an override raises it. Let’s Encrypt takes override requests through its rate limit form, and says they take a few weeks to process. File it before you need it.

Google Trust Services rate limits

Google counts Public CA quotas per Google Cloud project. Every ACME account in a project shares that project’s quota, and one project’s use doesn’t affect another’s.

ACME request	Default quota per project
New orders (newOrder)	100 per hour
New authorizations (newAuthz)	300 per hour
New accounts (newAccount)	25 per minute and 100 per hour
Challenges (challenge)	100 per minute
Authorization polls (authz)	600 per minute
Certificate polls (cert)	50 per minute
Revocations (revokeCert)	25 per 30 seconds

Production and staging have separate quotas, so testing in staging doesn’t use production capacity.

Google doesn’t say whether the Public CA quotas can be raised. To get more capacity, use more projects. Each EAB secret registers one ACME account, belongs to the project it came from, and has to be used within 7 days.

AWS Certificate Manager

AWS gives every customer their own ACME endpoint. ACM’s quotas allow 50 endpoints per account per Region, 1,500 domain validations per endpoint, and 1,000 EAB credentials per endpoint. Each of these can be raised in Service Quotas. An ACME order can include up to 100 names, and that limit is fixed.

AWS also limits ACME requests per second. Its two quota pages disagree on the numbers. The ACM User Guide says one finalize request per second, and the General Reference says 50. Even at one a second, 30,000 orders finish in a little over eight hours.

CAs that limit by purchase

ZeroSSL

ZeroSSL says its ACME service has no rate limits. It reserves the right to throttle abuse, and it caps how many EAB credentials a user can create, both per day and in total. It doesn’t publish any of those numbers.

SSL.com

SSL.com says it imposes no issuance rate limits on ACME. You pay for each certificate as usual, and the names you request decide which certificate type you’re billed for.

Actalis

Actalis publishes no ACME rate limits. Its plans include unlimited 90-day single-domain DV certificates through ACME, even on the free plan. Multi-domain certificates count against what your plan includes.

DigiCert

DigiCert publishes no ACME rate limits for DigiCert ONE, the directory CertKit uses. CertKit issues against an order you buy from DigiCert first.

GlobalSign

GlobalSign publishes no ACME rate limits. Atlas counts issuance against your SAN license or product pack. A SAN license counts each unique name on an active certificate once, so reissuing the same names doesn’t use more of it. A wildcard name usually counts as five. A product pack draws down with every certificate. A GlobalSign EAB key works for 30 days or 1,000 uses.

GoDaddy

GoDaddy publishes no ACME rate limits. Each EAB credential belongs to one purchased certificate, so moving many certificates to GoDaddy means buying many certificates.

Sectigo

Sectigo publishes no ACME rate limits. CertKit issues against an order you buy from Sectigo first.

Planning a large migration

Most domains never get near these limits. In October 2026, our count of active certificates in CT logs showed at least 99.4% of registered domains with 30 or fewer active certificates, which fits inside Let’s Encrypt’s per-domain burst. At default limits, one account or project issues new certificates in about this long.

Certificates on one account	Google Trust Services, one project	Let’s Encrypt, one account
30	Under a minute	Under a minute
300	About 2 hours	Under a minute
3,000	About 29 hours	About 27 hours
30,000	About 12.5 days	About 12.4 days

The Let’s Encrypt column assumes no registered domain needs more than 50 new certificates.

When the numbers are bigger than that, split the work where the limit is per account and plan ahead where it isn’t.

In CertKit, every issuer that uses EAB is its own ACME account, and you can add more than one issuer for the same CA. A certificate uses whichever issuer you assign it. To add capacity at Google Trust Services, give each issuer its own Google Cloud project. Issuers in the same project share its 100 orders an hour.

MSPs should add issuers in each client’s account, with each client’s own credentials and, for Google Trust Services, each client’s own project. Then one client’s migration doesn’t use up another client’s quota.

You can also spread certificates across CAs. If your domains publish CAA records, they have to allow every CA you issue from, so add those CAs before the day you need them.

Limits that count per registered domain across every account, like Let’s Encrypt’s, can’t be split. File the override request before you need it. For CAs that limit by purchase, check how much entitlement you have left (unused orders, subscribed domains, SAN license headroom) while there’s still time to buy more.

Set up a second issuer and issue a test certificate from it now. If your CA is distrusted, you’ll only need to point certificates at an issuer that already works.