ratelimits: Check at NewOrder and SpendOnly later

letsencrypt / boulder

An ACME-based certificate authority, written in Go.

Mozilla Public License 2.0

5.16k stars 605 forks source link

ratelimits: Check at NewOrder and SpendOnly later #7669

Closed beautifulentropy closed 1 month ago

beautifulentropy commented 1 month ago

Check CertificatesPerDomain at newOrder and spend at Finalize time.
Check CertificatesPerAccountPerDomain at newOrder and spend at Finalize time.
Check CertificatesPerFQDNSet at newOrder and spend at Finalize time.
Fix a bug inFailedAuthorizationsPerDomainPerAccountSpendOnlyTransaction() which results in failed authorizations being spent for the exact FQDN, not the eTLD+1.
Remove redundant "max names" check at transaction construction time
Enable key-value rate limits in the RA

github-actions[bot] commented 1 month ago

@beautifulentropy, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

beautifulentropy commented 1 month ago

@beautifulentropy, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values.

Filing a ticket with #7666 to ensure that the RA gets hooked up and I'll ensure that there's no dependence on it unless it's configured and the flag is flipped.