News for hackers. Stuff that matters.

A comment on Rate Limits. Parent comment

Re:Rate Limits by pfg on Wednesday August 17, 2016 @02:22PM (#12307004)
The signing capacity of the HSM (or possibly HSMs, I'm not sure) holding the intermediate certificate is limited. These devices are quite expensive, so it's not that easy to scale this resource. In comparison to that, a pending authorization is just a row in some table, so that doesn't take up too many resources.

For use-cases like Plex (or generally things that require a large number of subdomains), there's now a form you can use to request rate limit adjustments[1].

[1]: https://docs.google.com/forms/d/e/1FAIpQLSfg56b_wLmUN7n-WWhb...

[ Parent | on HN ]
Re:Rate Limits by jaas on Wednesday August 17, 2016 @03:07PM (#12307435)
HSM signing capacity is not infinite, and HSMs are expensive, but the real issue is just general DOS attacks. We aren't anywhere near our HSM capacity at the moment.

It's easy to set up tons of subdomains and request gobs of certs, which generally eats into the resources we have (database, bandwidth, HSMs). We need to limit that behavior to make sure legitimate users are getting good service.

[ Parent | on HN ]
Re:Rate Limits by nickpsecurity on Wednesday August 17, 2016 @02:58PM (#12307356)
Are you able to disclose the speed and/or cost? I know people working on cheaper HSM's. They might find the numbers useful as an assessment of how practical their own are.
[ Parent | on HN ]
Re:Rate Limits by pfg on Wednesday August 17, 2016 @03:11PM (#12307470)
I don't have any first-hand knowledge, sorry. (Not affiliated with ISRG.)

Based on some public posts, I believe Let's Encrypt is using Gemalto HSMs, though I'm not sure which model or how many of them.

[ Parent | on HN ]