cert-manager "Failed to request Order: 400 urn:ietf:params:acme:error:rateLimited"

Fix cert-manager ACME rateLimited order failures

TL;DR

You hit the ACME rate limit, usually the 5-duplicate-certs-per-week cap, because failed validations kept retrying. Stop issuing, fix the underlying challenge failure, test against the staging issuer, and wait out the window. Retrying against production just burns more quota and extends the pain.

cert-manager "Failed to request Order: 400 urn:ietf:params:acme:error:rateLimited"

Steps

1. Confirm the limit and the domain set. Run kubectl describe on the ClusterIssuer, Certificate, and the failed Order. Expected: the order error is rateLimited and you see exactly which domains are affected.

2. Check your issuance history. Run kubectl get certificates,orders -A and count recent successful issuances for the same domain set. Expected: you see the duplicate pattern that tripped the limit.

3. Fix the real problem first. Failed validations burn quota, so resolve the DNS-01 or HTTP-01 issue before anything else. Expected: a challenge for the same domain would pass if you tried it on staging.

4. Test against the staging issuer. Point the Certificate's issuerRef at your staging ClusterIssuer temporarily. Expected: staging issues the cert with no rate limit complaints, proving your config works.

5. Wait out the window, then switch back. The duplicate-cert limit is per rolling week. Once clear, point issuerRef back at production. Expected: the production order succeeds.

6. Prevent the repeat. Reuse one certificate across ingresses instead of minting one per host set, and never test against the production ACME endpoint. Expected: no repeat the next time you iterate on challenge config.

Use this when

• cert-manager orders fail with rateLimited
• Certificate renewals are blocked after config changes
• You were testing challenge configs against production

Not for this skill when

• The challenge itself fails (DNS-01 or HTTP-01 errors are a different fix)
• The ACME server is unreachable (connection refused, timeouts)
• You use a private CA issuer instead of ACME

Variant phrasings

• cert manager too many certificates already issued
• letsencrypt rate limit kubernetes
• acme rateLimited 400 cert-manager
• failed to request order rate limited

Why it happens

ACME CAs cap duplicate certificates (5 per week per exact domain set) to stop runaway issuance. cert-manager retries failed orders aggressively, so a broken challenge configuration burns through that quota fast, and then even a fixed config cannot issue until the window passes.

Edge cases

• The failed-validations limit (5 per hour per account per hostname) is separate and much shorter. Know which one you hit.
• Wildcard certificates require DNS-01. HTTP-01 will never work for them, and retrying will not help.
• Deleting the Certificate resource does not reset the CA-side counter. The window passes on the CA's clock, not yours.
• If you manage many subdomains, consider one wildcard cert instead of dozens of duplicates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BITIyiSeWBkf2znUUoeVIQ