You cannot reset a Let's Encrypt rate limit, but capacity refills over time, so the fix is to find what burned it, stop that loop, and wait. The usual causes are a client reinstalled in a loop, config deleted on every deploy, or failing validations. Test against the staging environment instead.
How the limits work
Let's Encrypt uses a token bucket. You can burst up to the full limit or spread requests out, and capacity returns gradually. There is no manual reset, and revoking certificates does not restore capacity. The service is designed so that renewals almost never hit a limit.
The limits that bite developers
The numbers below are from the documentation as last updated in August 2026. Check the page before you plan around them.
| Limit | Value |
|---|---|
| New orders per account | 300 per 3 hours |
| Certificates per registered domain | 50 per 7 days |
| Certificates per exact set of names | 5 per 7 days |
| Authorization failures per name per account | 5 per hour |
The exact set limit is the one teams hit by accident. It is intentionally low so buggy systems do not drain other capacity.
Common causes
- Reinstalling the client while chasing an unrelated error.
- Deleting ACME client state on each deploy, so every container start asks for a new certificate rather than renewing.
- Validation that cannot succeed. For HTTP-01 and TLS-ALPN-01 this is usually a firewall or network rule. For DNS-01 it is often a typo or a missed CNAME during setup. See the challenge types compared.
- Many small sites on one registered domain, each issuing separately.
What to do right now
- Read the error. It names the limit and when you can retry.
- Stop automated retries. Looping makes consecutive authorization failures worse, and Let's Encrypt can pause issuance for a name after sustained failures.
- Persist your ACME account and certificate files on a volume so redeploys renew rather than reissue.
- If you must issue urgently under the exact set limit, changing the set of names, for example adding a hostname, creates a new set. Those orders do not count as renewals, so they still hit the other limits.
- For very large estates, overrides exist for some limits, requested per account or domain. Several limits offer none.
Prevent it
Point test runs and CI at staging, which has far higher limits. Add monitoring that alerts when a certificate is not renewed on schedule, so you notice a failing renewal weeks before expiry. The expiry outage checklist covers the alerts.
Where Safeguard fits
Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.
Quick check
Does revoking a certificate give me my limit back?
No. The resources used to issue it were already consumed.
Do renewals count toward rate limits?
They are designed to almost never hit one, but a new set of names is treated as a new order, not a renewal.
Sources
Last reviewed: 19 October 2026.
