[Question]How many domains can a zeroSSL 90 day wildcard certificate support at most

[ningkexin]

I received the following error directly when applying for 16 domain names

The retryafter=86400 value is too large (> 600), will not retry anymore.

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[ignoramous]

Looks related to fixes made for #5293 as the retryAfter header set by ZeroSSL REST API goes up to 86400 seconds (equals 1 day), which prompts acme.sh (v3.1.0 onward) to exit.

2025-10-29T04:06:46.9009483Z [Wed Oct 29 04:06:46 UTC 2025] Processing. The CA is processing your order, please wait. (1/30)
2025-10-29T04:06:46.9035516Z [Wed Oct 29 04:06:46 UTC 2025] Sleep 2 seconds before verifying again
2025-10-29T04:06:48.9082896Z [Wed Oct 29 04:06:48 UTC 2025] Checking
2025-10-29T04:06:48.9110363Z [Wed Oct 29 04:06:48 UTC 2025] =======Sending Signed Request=======
2025-10-29T04:06:48.9137583Z [Wed Oct 29 04:06:48 UTC 2025] url='https://acme.zerossl.com/v2/DV90/authz/<deadb33f>'
2025-10-29T04:06:48.9163942Z [Wed Oct 29 04:06:48 UTC 2025] payload
2025-10-29T04:06:48.9189304Z [Wed Oct 29 04:06:48 UTC 2025] Use cached jwk for file: /home/runner/.acme.sh/ca/acme.zerossl.com/v2/DV90/account.key
2025-10-29T04:06:48.9288646Z [Wed Oct 29 04:06:48 UTC 2025] Use _CACHED_NONCE='<deadb33f>'
2025-10-29T04:06:48.9314967Z [Wed Oct 29 04:06:48 UTC 2025] nonce='<deadb33f>'
2025-10-29T04:06:48.9871701Z [Wed Oct 29 04:06:48 UTC 2025] POST
2025-10-29T04:06:48.9895779Z [Wed Oct 29 04:06:48 UTC 2025] _post_url='https://acme.zerossl.com/v2/DV90/authz/<deadb33f>'
2025-10-29T04:06:48.9923939Z [Wed Oct 29 04:06:48 UTC 2025] body='{"protected": "<deadb33f>", "payload": "", "signature": "<defadb33f>"}'
2025-10-29T04:06:48.9945924Z [Wed Oct 29 04:06:48 UTC 2025] _postContentType='application/jose+json'
2025-10-29T04:06:48.9979993Z [Wed Oct 29 04:06:48 UTC 2025] Http already initialized.
2025-10-29T04:06:49.0005035Z [Wed Oct 29 04:06:49 UTC 2025] _CURL='curl --silent --dump-header /home/runner/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.....  -g '
2025-10-29T04:06:49.2301208Z [Wed Oct 29 04:06:49 UTC 2025] _ret='0'
2025-10-29T04:06:49.2347142Z [Wed Oct 29 04:06:49 UTC 2025] responseHeaders='HTTP/2 200 
2025-10-29T04:06:49.2349302Z server: nginx
2025-10-29T04:06:49.2351114Z date: Wed, 29 Oct 2025 04:06:49 GMT
2025-10-29T04:06:49.2352490Z content-type: application/json
2025-10-29T04:06:49.2353850Z content-length: 305
2025-10-29T04:06:49.2355189Z replay-nonce: <deadbeef>
2025-10-29T04:06:49.2356530Z cache-control: max-age=0, no-cache, no-store
2025-10-29T04:06:49.2358103Z access-control-allow-origin: *
2025-10-29T04:06:49.2366275Z link: <https://acme.zerossl.com/v2/DV90>;rel="index"
- 2025-10-29T04:06:49.2367045Z retry-after: 86400
2025-10-29T04:06:49.2367908Z strict-transport-security: max-age=31536000; includeSubDomains
2025-10-29T04:06:49.2369064Z 
2025-10-29T04:06:49.2369357Z '

I had incorrectly assumed that missing socat dependency from the Ubuntu server was the issue, but that wasn't it.

For us, downgrading to 3.0.9 fixes the > 600 issue for the time being with ZeroSSL.

# github.com/acmesh-official/acme.sh/wiki/How-to-install#4-advanced-installation
git clone --depth 1 https://github.com/acmesh-official/acme.sh.git --branch 3.0.9

cd acme.sh
./acme.sh --install --accountemail "<email@tld>"