New Order / Old Account

[GeorgeSchiro]

Thomas, here's what we've been doing so far with every certificate request:

New-ACMENonce      "C:\AcmeState"
New-ACMEAccountKey "C:\AcmeState"
New-ACMEAccount    "C:\AcmeState" -EmailAddresses "[email protected]" -AcceptTOS -PassThru
New-ACMEOrder      "C:\AcmeState" -Identifiers ("MyDomain.com")

We're now seeing rate limits while ramping up to many domains.

I've reviewed issue #110 and was hoping I could cherry-pick the "AcmeState" folder for the bare minimum required to resolve this issue. We don't want to retain the full ACME state.

Can we place an old "AccountKey.xml" file into the ACME state folder in lieu of running the 1st 3 commands? (ie. those above "New-ACMEOrder"). Or, alternatively, can we run the 1st 3 commands and then overwrite the newly created "AccountKey.xml" file with the old one created during a previous run?

[glatzert]

Hi George,
you can reuse the AccountKey.xml and Account.xml as you like, but I think they must always go in tandem, since the identifier on Let's Encrypt is created from the Account Key.

We do this 'here', to reuse the account with more computers in our domain, since we have a relaxed rate limit for our main domain on that account.

[GeorgeSchiro]

Hmm, looking at 4 examples of rate limit failures, none of them contain an "Account.xml" file. Each contains only an "AccountKey.xml" file (plus other apparently non-account specific files). They all failed on "New-ACMEOrder".

The one example we have with another type of failure (ie. "New-ACMEOrder" proceeded normally) does include an "Account.xml" file. That suggests that only a successful "New-ACMEOrder" results in an "Account.xml" output file. Is that right?

[glatzert]

AccountKey.xml is a local resource and will 'always' succeed.
The Account.xml will be created, when the account creation with your ACME service succeeded - it's a 'remote' resource.

[glatzert]

BTW: If you use -Verbose, ACME-PS will tell you what it reads and writes.

[GeorgeSchiro]

I almost forgot to follow-up Thomas. Using old copies of "Account.xml" and "AccountKey.xml" resolved the issue. No more rate limits. Thanks again!