{"action":"created","issue":{"url":"https://api.github.com/repos/certbot/certbot/issues/5208","repository_url":"https://api.github.com/repos/certbot/certbot","labels_url":"https://api.github.com/repos/certbot/certbot/issues/5208/labels{/name}","comments_url":"https://api.github.com/repos/certbot/certbot/issues/5208/comments","events_url":"https://api.github.com/repos/certbot/certbot/issues/5208/events","html_url":"https://github.com/certbot/certbot/issues/5208","id":269210067,"node_id":"MDU6SXNzdWUyNjkyMTAwNjc=","number":5208,"title":"Improve UX for users who request more than 300 domains in a single cert","user":{"login":"bmw","id":6504915,"node_id":"MDQ6VXNlcjY1MDQ5MTU=","avatar_url":"https://avatars0.githubusercontent.com/u/6504915?v=4","gravatar_id":"","url":"https://api.github.com/users/bmw","html_url":"https://github.com/bmw","followers_url":"https://api.github.com/users/bmw/followers","following_url":"https://api.github.com/users/bmw/following{/other_user}","gists_url":"https://api.github.com/users/bmw/gists{/gist_id}","starred_url":"https://api.github.com/users/bmw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmw/subscriptions","organizations_url":"https://api.github.com/users/bmw/orgs","repos_url":"https://api.github.com/users/bmw/repos","events_url":"https://api.github.com/users/bmw/events{/privacy}","received_events_url":"https://api.github.com/users/bmw/received_events","type":"User","site_admin":false},"labels":[{"id":272789317,"node_id":"MDU6TGFiZWwyNzI3ODkzMTc=","url":"https://api.github.com/repos/certbot/certbot/labels/area:%20error%20handling","name":"area: error handling","color":"c5def5","default":false},{"id":200596079,"node_id":"MDU6TGFiZWwyMDA1OTYwNzk=","url":"https://api.github.com/repos/certbot/certbot/labels/area:%20ui%20/%20ux","name":"area: ui / ux","color":"c5def5","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-10-27T19:24:13Z","updated_at":"2018-06-19T18:32:35Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Let's Encrypt has a limit of 100 names per cert and 300 pending authorizations per account. Currently nothing in Certbot prevents you from making a request for 300+ domains though. If a user does this, Certbot creates as many authorizations as it can, gets rate limited, and exits with a message about too many pending authorizations which doesn't describe the root problem here.\r\n\r\nWe should see if we can improve this. Really what we'd like to happen is to error early and say that you are trying to include too many names in the cert. While writing code to error at more than 100 names is trivial, this number is specific to Let's Encrypt policy, not in the ACME spec, and could change at any time. As versions of Certbot get entombed in Linux distros that are hesitant to do upgrades, a hard limit like this would prevent Certbot users from issuing certs that the CA would otherwise accept.\r\n\r\nWhile it's not immediately clear how to fix this, luckily this problem will be resolved in the new version of the ACME protocol Let's Encrypt is launching in January. In the current ACME flow, the client doesn't tell the server what names it wants in a cert until the end of the process. In the new ACME flow, this is given to the server first so the server can reject the request for a cert with too many names before any authorizations are created.\r\n\r\nIf we can reasonably and easily fix this in the current protocol we should, but it's not immediately clear how to do this and the problem will be going away soon anyway."},"comment":{"url":"https://api.github.com/repos/certbot/certbot/issues/comments/398500543","html_url":"https://github.com/certbot/certbot/issues/5208#issuecomment-398500543","issue_url":"https://api.github.com/repos/certbot/certbot/issues/5208","id":398500543,"node_id":"MDEyOklzc3VlQ29tbWVudDM5ODUwMDU0Mw==","user":{"login":"jsha","id":220205,"node_id":"MDQ6VXNlcjIyMDIwNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/220205?v=4","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"created_at":"2018-06-19T18:32:35Z","updated_at":"2018-06-19T18:32:35Z","author_association":"CONTRIBUTOR","body":"I think it would be reasonable for Certbot to say it refuses to manage certificates with >100 domains, regardless of provider. Such large certificates are harmful to the ecosystem, and also probably tickle untested areas of Certbot's code, in terms of performance."}}
{"actor":{"display_login":"jsha"}}