Cloud Manager blocks SSL certificate creation when certificate or DV rate limits are reached
Cloud Manager can fail to add a new SSL certificate when the program reaches its installed certificate limit or when Adobe-managed DV issuance hits a Let’s Encrypt rate limit. In these cases, certificate creation can fail with generic UI errors, a MAX_NUMBER_OF_CERTIFICATES_REACHED response, or a persistent FAILED status. The issue can also occur when too many Adobe-managed DV certificates are created for the same exact set of domains within seven days, or when wildcard coverage is required. Review the current certificate inventory, remove unused certificates, group domains with SAN certificates, and retry after any rate-limit window resets.
Description description
Environment:
- Adobe Experience Manager as a Cloud Service (AEMaaCS)
- Cloud Manager
Issue/Symptoms:
- Cloud Manager fails to add an SSL certificate and shows a generic error such as Unknown Error or SSL Certificate generic error.
- The browser network console or API response shows
MAX_NUMBER_OF_CERTIFICATES_REACHED. - Adobe-managed DV certificate creation remains in
FAILEDstatus. - Certificate creation fails after multiple attempts for the same exact domain set within seven days.
Cause:
The most common cause is that the program has reached the maximum allowed number of installed SSL certificates, including active, unused, and expired certificates. Adobe-managed DV certificates also rely on Let’s Encrypt, which limits issuance to five certificates for the same exact set of identifiers within a rolling seven-day window. If either limit is reached, Cloud Manager cannot create the certificate until capacity is restored or the rate-limit window resets.
Resolution resolution
To fix this issue, follow these steps:
- In Cloud Manager, open SSL Certificates and review all installed certificates for the program.
- Delete expired or unused certificates to reduce the total certificate count below the program limit.
- When you add a new Adobe-managed DV certificate, group multiple verified domains under one certificate to reduce certificate usage. One certificate can include up to 100 SANs.
- If you created more than five Adobe-managed DV certificates for the same exact set of identifiers within seven days, wait for the rate-limit window to reset before retrying.
- If the domain requires wildcard coverage such as
*.example.com, use a customer-managed OV/EV certificate because Adobe-managed DV certificates do not support wildcards. - If custom domains and certificates are not required in non-production environments, remove them and use the default Adobe-provided internal URLs instead.
- Retry certificate creation and verify that the certificate moves to
VALIDorREADYinstead ofFAILED. - Contact Adobe Support if the program is below 70 certificates but the limit still triggers, if DV issuance stays in
FAILEDstatus for more than 24 hours, or if rate-limit behavior appears inconsistent.