Point your ACME client at the Let's Encrypt staging directory, https://acme-staging-v02.api.letsencrypt.org/directory. It follows the same flow as production with far higher limits, but its certificates are not trusted by browsers. With Certbot, add the dry-run or test-cert flag and run your whole renewal path.
Why staging exists
Production limits are tuned for real certificates. Testing a new deployment, a Kubernetes setup or a DNS plugin can burn through them quickly, and you cannot reset a rate limit once hit. Staging mirrors the production hierarchy so you can find mistakes first.
How limits differ
| Limit | Staging | Production |
|---|---|---|
| Orders per account | 1500 per 3 hours | 300 per 3 hours |
| Certificates per exact set of names | 30000 per week | 5 per 7 days |
| Authorization failures per name | 200 per hour | 5 per hour |
Figures come from the Let's Encrypt documentation at the time of review and can change.
Steps
- Use the staging URL in your client's server setting, or for Certbot run a dry run:
certbot certonly --dry-run -d example.com
certbot renew --dry-run
- Expect a separate account. ACME accounts are scoped to each environment, so staging needs its own. Certbot handles this for you.
- Run the whole path. Do not stop at issuance. Check your reload hook, file permissions and the renewal schedule.
- Switch to production by removing the staging setting, and then confirm the live certificate with a normal client.
Staging certificates will look untrusted
Staging roots carry names such as Pretend Pear X1 and are not present in browser or client trust stores. That is intended. A testing client can trust them by adding their certificates to a trust store used just for tests. Do not add them to a store you use for ordinary browsing, because they are not audited to production standards.
What to check once staging works
- The certificate issuer name shows a staging authority, which confirms you really hit staging.
- Your web server picked up the file, not just the client. See reloading without downtime.
- Your monitoring sees the new expiry date.
- Logs show no authorization failures you were ignoring.
A caution on custom servers
A dry run uses staging unless you set a server explicitly. Certbot warns that combining a dry run with a custom server may cause real certificates to be issued and discarded, so check the server setting before you run it in CI.
Where Safeguard fits
Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.
Quick check
Why does my browser reject a staging certificate?
Staging roots are deliberately absent from public trust stores, so the warning means staging works as designed.
Do I need a separate ACME account for staging?
Yes. Accounts are scoped to each environment, and Certbot creates it for you.
Sources
Last reviewed: 19 October 2026.
