search

publishlab / node-acme-client

Simple and unopinionated ACME client for Node.js
MIT License
266 stars 52 forks source link

Issue with "too many currently pending authorizations" #52

Closed silverwind closed 2 years ago

silverwind commented 3 years ago

I'm using this module to do ACMEv2 challenges for a lot of domains and sometimes I run into this error:

Error: Error creating new order :: too many currently pending authorizations: see https://letsencrypt.org/docs/rate-limits/
    at AcmeApi.apiRequest (node_modules/acme-client/src/api.js:54:19)
    at runMicrotasks (<anonymous>)
    at async AcmeClient.createOrder (node_modules/acme-client/src/client.js:281:22)

My code is pretty much exactly following the example from https://github.com/publishlab/node-acme-client/blob/master/examples/api.js.

What I gather, this is a client-caused error with too many open (e.g. unfulfilled) authorization requests. My requests fail for various reasons that are not in my control and I wonder if this module could either automatically cancel/destroy failed authorization request or expose a method to do so (that could be called in case of a challenge error).

From https://community.letsencrypt.org/t/error-429-too-many-pending-authorizations/27273/7:

if you get an authz for one requested domain but fail to get it for another, make sure you proactively destroy the first authz before giving up

According to https://community.letsencrypt.org/t/too-many-currently-pending-authorizations/64571 it sounds like the issue should be "mitigated" by using ACME v2, but I certainly still see it.

nmorsman commented 3 years ago

Hey @silverwind,

Thanks for reporting this and digging up the relevant info. I'll take a look at implementing authz deactivation when an order fails as soon as possible.

nmorsman commented 2 years ago

Hello again,

Possible fix for this has been implemented in 03ab0866406a846c99a38e25625c929cb2488df6, both in the API example provided and when using the auto() method. It will now deactivate pending authorizations where challenges can not be completed, using client.deactivateAuthorization(authz);.

Since this edge case is a bit tricky to reproduce without hammering the LE API, I haven't been able to confirm if this fixes the issue or not. Please re-open this if the problem persists.

silverwind commented 2 years ago

Thanks, I will try that later. It might take me some time to get around to it.