5 ms·

Any word on *.mydomain.tld certs from letsencrypt? That's the only thing stopping me from installing it today.

by sleepychu 11y ago

simoncion 11y ago
Is the ability to get any number of subdomain certs at no charge an adequate substitute for wildcard certs?
- detaro 11y ago
  It still might get annoying (for both sides) if you request thousands of them, + you might not want to publish a list of all valid ones. Example: The issue came up in relation to sandstorm.io, which uses (for security reasons) a subdomain for every document that exists on a server.
  - simoncion 11y ago
    Perhaps I'm ignorant, but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) > + you might not want to publish a list of all valid ones. I assume that you mention this to illustrate a scenario where certs with a bunch of SANs is not a solution to the problem? If you weren't, does LE do something like publishing a list of all of the domains for which they have issued certs?
    - detaro 11y ago
      > does LE do something like publishing a list of all of the domains for which they have issued certs? Yes, they do, using certificate transparency logs. You can view all issued certs here: https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
    - archimedespi 11y ago
      > but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) We have to actually run a complicated server that does things with an external Hardware Security Module. CPU time, disk space, and bandwidth all cost money, and there's a finite amount of money we can spend on resources :) Thus, rate-limits. That also helps keeps latency low for most users, and prevents DDOSing.
- sleepychu 11y ago
  I looked into it a while ago (it would be fine for me if it worked) but I think the problem I came up against was if I'm using virtual hosts in apache, I'm not sure I can use two different certs for a.mydomain.com and b.mydomain.com. If I'm wrong please tell me!
  - Tepix 11y ago
    Yes you can, even on the same IP address with a technique called SNI. It's built into Apache and all common web browsers so you don't even have to worry about it.
    - sleepychu 11y ago
      Sounds good, do I need to change my apache config? Currently I have a bunch of port 80 virtual hosts that permanently redirect to their https/443 counterparts which are also virtual hosts and those all offer the same wildcard *.mydomain.com certificate. Or will apache just do SNI if I use a bunch of different certs?
      - Tepix 11y ago
        Yes. Sounds like you are already using SNI without realizing it (if they are using the same IP address).
detaro 11y ago
I don't believe there are any published plans to support wildcard certs.
- simoncion 11y ago
  According to this comment, [0] it looks like wildcard certs haven't been ruled out, but have been deferred due to rather thorny issues regarding getting automated validation right. [0] https://github.com/letsencrypt/acme-spec/pull/97#issuecomment-108646570 https://github.com/letsencrypt/acme-spec/pull/97#issuecommen...

Any word on *.mydomain.tld certs from letsencrypt? That's the only thing stopping me from installing it today.

simoncion 11y ago

Is the ability to get any number of subdomain certs at no charge an adequate substitute for wildcard certs?

detaro 11y ago
It still might get annoying (for both sides) if you request thousands of them, + you might not want to publish a list of all valid ones. Example: The issue came up in relation to sandstorm.io, which uses (for security reasons) a subdomain for every document that exists on a server.
- simoncion 11y ago
  Perhaps I'm ignorant, but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) > + you might not want to publish a list of all valid ones. I assume that you mention this to illustrate a scenario where certs with a bunch of SANs is not a solution to the problem? If you weren't, does LE do something like publishing a list of all of the domains for which they have issued certs?
  - detaro 11y ago
    > does LE do something like publishing a list of all of the domains for which they have issued certs? Yes, they do, using certificate transparency logs. You can view all issued certs here: https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
  - archimedespi 11y ago
    > but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) We have to actually run a complicated server that does things with an external Hardware Security Module. CPU time, disk space, and bandwidth all cost money, and there's a finite amount of money we can spend on resources :) Thus, rate-limits. That also helps keeps latency low for most users, and prevents DDOSing.
sleepychu 11y ago
I looked into it a while ago (it would be fine for me if it worked) but I think the problem I came up against was if I'm using virtual hosts in apache, I'm not sure I can use two different certs for a.mydomain.com and b.mydomain.com. If I'm wrong please tell me!
- Tepix 11y ago
  Yes you can, even on the same IP address with a technique called SNI. It's built into Apache and all common web browsers so you don't even have to worry about it.
  - sleepychu 11y ago
    Sounds good, do I need to change my apache config? Currently I have a bunch of port 80 virtual hosts that permanently redirect to their https/443 counterparts which are also virtual hosts and those all offer the same wildcard *.mydomain.com certificate. Or will apache just do SNI if I use a bunch of different certs?
    - Tepix 11y ago
      Yes. Sounds like you are already using SNI without realizing it (if they are using the same IP address).

detaro 11y ago

I don't believe there are any published plans to support wildcard certs.

simoncion 11y ago
According to this comment, [0] it looks like wildcard certs haven't been ruled out, but have been deferred due to rather thorny issues regarding getting automated validation right. [0] https://github.com/letsencrypt/acme-spec/pull/97#issuecomment-108646570 https://github.com/letsencrypt/acme-spec/pull/97#issuecommen...