Certificate Issuance Rate Limiting

[mb91]

A Certificate Issuance Rate Limiting would be very usefule (like at Let's Encrypt; for example 50 certificates every 7 days). It would prevent the Windows CA from "overheating" if an administrator has configured his ACME client wrong or simply the cronjob interval to short.

I could imagine adding an extra parameter at the issuance profile's.
For example "IssuanceLimitDay", which regulates the number of issuances per day per account.

[glatzert]

Rate limiting isn't that simple here.
I assume the product is used in scenarios, where there's only (more or less) one second level domain. This is where Let's Encrypt does the rate limiting currently (like 100 per day per second level domain OR if it's a known public prefix, then "third level" domain). The account only has a secondary role in LEs rate limits, e.g. it may be used to loosen the limits.

Also accounts may be created at will, so if we assume an misconfigured server, that spams the ACME service, we should take that into account (no pun intended).

So for account creation, we could rate limit by IP address. That's simple.
For certificate issuance, it's not that clear on what specific data the limiting should occur.

• Using the account will be problematic in cases, where there's a single account for all servers only.
• Using the IP address will be problematic in cases, where there's a single server having a lot of names
• Using the SANs isn't currently feasable, as the ACME server does not track them individually. Nevertheless - this could be used, but has limitations in server farm scenarios and alike.

[glatzert]

I read a little about the performance of a MS ADCS. The article is about Windows Server 2008 and supposes a machine with 4GB RAM and a normal CPU for that time will be able to issue ~120 certificates per second.
Since everything is designed for "in-house" usage, I'm not sure, if I should invest the time in rate limiting or not.

[glatzert]

After a little chat with @mb91, we came to the conclusion, that monitoring the issuance will currently probably be more useful, since we're not sure on what the rate limiting will occure.
Monitoring will be used to talk to administrators, where issuance cron-jobs are misconfigured and "hammer" on the ACME-ADCS service.

If someone chimes in and either would like to see ARI support or a proper rate limiting and also has an idea how the rate limiting might occur in a non-problematic manner, we'll reconsider implementing it.