The limits are generous for a production site and easy to exhaust from a staging environment, because they count against the registered domain rather than the hostname — so every subdomain shares one budget.
# 20 certificates per registered domain per week
# 5 duplicate certificates (same exact name set) per week
# 5 failed validations per account, per hostname, per hour
certbot certonly --dry-run --webroot -w /var/www/public -d shop.example.comFive duplicates a week is the one that bites: a deploy script re-issuing on every release burns through it by Wednesday and then cannot renew the production certificate either. --dry-run hits the staging endpoint, which has its own much larger limits and issues an untrusted certificate — so it validates the whole flow without spending anything. Automate the renewal, never the issuance.