Entrust PKIaaS enforces the following quotas and limits.

Region limits

PKIaaS currently supports setting up your PKI in the US or EU regions.

You can set up your whole trust chain (root CA and issuing CA) in the same region.
PKIaaS does not support cross-region trust chains; you cannot sign an issuing CA using a root CA from another region.

Rate limits

PKIaaS has two tiers of quotas based on your PKIaaS certificate inventory.

Quota	Purchased certificates
Standard quota	Less than 1 million
Premium quota	1 million or more

To protect against burst requests and prevent abuse, PKIaaS enforces a request rate limit based on 10-second intervals.

Capability	Standard quota	Premium quota
Certificate creation	100 requests/10 seconds	1000 requests/10 seconds
OCSP	100 requests/10 seconds	1000 requests/10 seconds
CRL	100 requests/10 seconds	1000 requests/10 seconds
All others	100 requests/10 seconds	1000 requests/10 seconds

If the number of requests exceeds the allowed rate limit:

The API access is temporarily blocked
All requests return a 429 HTTP status code with a "TooManyRequests" error message.

Certificate issuance capping

When the number of active certificates reaches the number of PKIaaS certificates purchased by your Entrust Certificate Service Enterprise account, PKIaaS blocks your account from issuing any additional certificates. To issue more PKIaaS certificates, you can either:

Revoke some of the active certificates.
Contact your sales representative to purchase more certificates.