# ca_rate_limited

The certificate authority is rate-limiting new certificates for this registrable domain.

## What it means

Let's Encrypt limits how many certificates it issues for one registrable domain (for example `acme.com`) per week. That limit was reached, so the CA refused this one. DNS is verified and the domain is routed; it gets its certificate once the window allows.

## Why it happens

- Many subdomains of the same customer domain were added in a short time, by you or by other services the customer uses.
- The same hostname was deleted and re-added repeatedly, which requests a new certificate each time.
- Another provider used by the customer issues many certificates under the same domain.

## What to do

1. Nothing: we retry automatically with backoff (1 min, 5 min, 30 min, 2 h, then every 12 h) and the domain goes `active` as soon as issuance succeeds.
2. Avoid deleting and re-adding hostnames to "unstick" them; it makes the limit last longer.
3. Retrying by hand is refused for this reason (`422 validation_failed`): a forced retry would only extend the limit.

- [Open this domain in the dashboard](/app/domains)
- [See the domain state machine](/docs/concepts/domain-states)

## In the API

```
"status": "cert_failed",
"status_reason":
  "ca_rate_limited",
"status_detail": {
  "registrable": "acme.com"
}
```