Fix Let's Encrypt Rate Limit (Too Many Certificates) on Coolify

Error: acme: error: 429 :: POST :: too many certificates already issued for exact set of domains, retry after ...

Let's Encrypt refused to issue a new certificate because you hit its issuance rate limit for that domain (HTTP 429), so HTTPS will not provision until the window resets.

Coolify's Traefik proxy re-requests a Let's Encrypt cert on every failed deploy or proxy restart. If DNS, port 80, or the domain config was wrong, repeated retries burn through Let's Encrypt's limits in a few hours, then 429-block you even after the underlying problem is fixed. The two limits that bite: 50 certificates per registered domain per 7 days, and 5 duplicate certificates per exact same set of domains per 7 days. The duplicate-set limit (5/week) is the one most Coolify users hit when retrying a single failing domain.

The fix

1. Stop retrying immediately. Every fresh issuance attempt while rate-limited consumes more of your quota and does not shorten the wait. First fix the real cause of the original failure before the window resets: DNS A/AAAA record pointing at the wrong IP, port 80 not reachable from the internet (Let's Encrypt needs it for the HTTP-01 challenge), or Cloudflare proxy (orange cloud) intercepting the challenge.

2. Confirm the rate-limited domain and read the 'retry after' value from the Coolify proxy logs.

   docker logs coolify-proxy --tail 200 2>&1 | grep -iE 'rateLimited|too many|429|retry after'

3. Check that DNS resolves to your server and the HTTP-01 challenge path is reachable on port 80 before the window resets, so the next single attempt actually succeeds. A 200/404 from your server (not a timeout or Cloudflare page) means port 80 is reaching Coolify.

   curl -sI http://your-domain.com/.well-known/acme-challenge/test

4. While you wait out the window, do NOT delete acme.json or restart the proxy repeatedly. Each proxy restart with a still-broken config triggers another blocked request. Leave it alone until both the underlying problem is fixed and the rate-limit window has elapsed.

5. When the window has elapsed (the duplicate-set limit refills roughly one certificate every 34 hours, or fully after 7 days from the first issuance in the window), force Coolify to request a fresh cert ONCE. Remove the stored ACME state and restart the proxy from the Coolify dashboard (Server > Proxy > Restart). This is Coolify's documented way to force regeneration.

   rm /data/coolify/proxy/acme.json

6. If the site must be up before the window resets, front the origin with Cloudflare's edge certificate using SSL/TLS mode Full (strict) so Cloudflare serves valid TLS to visitors while Let's Encrypt cools off, or temporarily serve the app on a different subdomain (a different exact set of domains has its own separate quota).

Verify it worked

Open https://your-domain.com in a browser and confirm a valid, trusted certificate (no warning), then confirm the issuer/dates from the CLI and that the proxy log shows a successful issuance rather than a 429.

echo | openssl s_client -connect your-domain.com:443 -servername your-domain.com 2>/dev/null | openssl x509 -noout -issuer -dates

Related Coolify errors

• NET::ERR_CERT_AUTHORITY_INVALID
• TRAEFIK DEFAULT CERT / self-signed certificate
• unable to obtain ACME certificate for domains "your-domain.com": unable to generate a certificate for the domains [your-domain.com]: error: one or more domains had a problem: [your-domain.com] acme: error presenting token / authorization failed
• ERR_TOO_MANY_REDIRECTS — This page isn't working. your-domain.com redirected you too many times.

Have Emsden Studio fix it for you — from A$149

All Coolify deploy errors