ca_rate_limited

What it means

Let's Encrypt limits how many certificates it issues for one registrable domain (for example acme.com) per week. That limit was reached, so the CA refused this one. DNS is verified and the domain is routed; it gets its certificate once the window allows.

Why it happens

• Many subdomains of the same customer domain were added in a short time, by you or by other services the customer uses.
• The same hostname was deleted and re-added repeatedly, which requests a new certificate each time.
• Another provider used by the customer issues many certificates under the same domain.

What to do

1. Nothing: we retry automatically with backoff (1 min, 5 min, 30 min, 2 h, then every 12 h) and the domain goes active as soon as issuance succeeds.
2. Avoid deleting and re-adding hostnames to "unstick" them; it makes the limit last longer.
3. Retrying by hand is refused for this reason (422 validation_failed): a forced retry would only extend the limit.