5 ms·
Does this support wildcard subdomains? If not, would you be willing to add such support?
by pytrin 11y ago
Does this support wildcard subdomains? If not, would you be willing to add such support?
- deleted 11y ago[deleted]
- toupeira 11y agoThis uses LetsEncrypt which doesn't support wildcard certificates yet: > Will Let’s Encrypt issue wildcard certificates? > We currently have no plans to do so, but it is a possibility in the future. Hopefully wildcards aren’t necessary for the vast majority of our potential subscribers because it should be easy to get and manage certificates for all subdomains. From https://community.letsencrypt.org/t/frequently-asked-questions-faq/26 https://community.letsencrypt.org/t/frequently-asked-questio...
- pytrin 11y agoUnfortunately, that doesn't work with dynamic subdomains (i.e, domains assigned and edited by users). Hopefully they'll change their minds in the future - until then, I'll be paying for a commercial certificate
- dyladan 11y agoYou could always script the letsencrypt API and generate a new certificate on each subdomain generation.
- pfg 11y agoThat's correct, however there are rather aggressive rate limits in place right now that would make this hard for your typical SaaS-on-a-subdomain deployment if you have more than ~5 new signups per week. Plus, if SAN support is a concern, wildcards are preferable too.
- jrochkind1 11y agoThe rate limits[1] I see documented are 500 registrations per 3 hours. That's a lot more than ~5 new signups per week. More like ~16800 new signups per week, no? [1] https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
- pfg 11y agoCertificates/Domain is the one that would affect this use-case the most. It's set to 5 certificates per domain per week. More specifically, it's certificates per TLD+1, so one certificate for customer1.example.com and one for customer2.example.com would put your rate limit for example.com at 2, thus limiting you to 5 signups per week unless you spread your SaaS over multiple TLD+1's.
- derefr 11y agoHow do they define a TLD? What's, for example, .co.uk to them?
- tokenizerrr 11y agoA TLD. They define domain as anything the average user can purchase.
- pfg 11y agoThey use the Public Suffix List[1]. [1]: https://publicsuffix.org/ https://publicsuffix.org/
- jrochkind1 11y agoHmm, are you sure they do? Including the "PRIVATE" section? Any docs from them saying this, and clarifying whether this includes the PRIVATE section? Because if so, that would seem to make the certs-per-domain limits not so much of a problem. If you own example.com, and have customers using sub-domains at a.example.com, b.example.com, etc -- that would seem to make example.com suitable for inclusion on the "PRIVATE" section of the list. No? "owners of privately-registered domains who themselves issue subdomains to mutually-untrusting parties may wish to be added to the PRIVATE section of the list... Requests for changes to the PRIVATE section must come from the domain owner." https://publicsuffix.org/submit/ https://publicsuffix.org/submit/ And indeed there are a few dozen random .com, .net, etc domains in the PRIVATE section. For instance `github.io` is listed there. If that's the way for SaaS providers to get free certs from letsencrypt for their customers at customername.provider.com, I'd expect to see the listings in the PRIVATE section skyrocket.
- novaleaf 11y agoi almost went down this route, then realized I could avoid all this R&D and just pay $40 for a wildcard cert.
- pytrin 11y ago$40? I paid over $90 for mine. Can I ask where you got it from?
- mfkp 11y agohttps://www.ssl2buy.com/alphassl-wildcard.php https://www.ssl2buy.com/alphassl-wildcard.php Here's where I got mine, works great.
- novaleaf 11y agoas mfkp said, that's where I got mine too. Important though, for compatability with firefox and some other browsers, you'll need to copy the intermediate cert to the end of the cert file. it works fine with 2 certs in the file, just put the intermediate at the end.
- gaia 11y agoHaving only a half a dozen subdomains, with maybe another half a dozen being added per year (well below the limits), are there any advantages to using a wildcard cert VS individual certs for the subdomains? In other words, any way to justify the extra $30/year for a wildcard cert?
- thecrazyone 11y agoIf you're thinking you're going to use LE, they're rate limits which make individual certs for sub domains unreasonable