3 ms·

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still h

by 0x0 11y ago

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.

EwanToo 11y ago
I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?
- 0x0 11y ago
  Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.
  - jhkaghjkga 11y ago
    That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
    - 0x0 11y ago
      That's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
  - Tepix 11y ago
    Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.
    - 0x0 11y ago
      That doesn't help when you are targeting a market where Android 2.x is prevalent.
      - Tepix 11y ago
        True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?
        0x0 11y ago
        You'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).
DanielDent 11y ago
Windows XP & older Android releases are the two most common reasons to care about SNI. Let's Encrypt actually has compatibility issues with Windows XP, so wildcard certificates wouldn't help. https://community.letsencrypt.org/t/which-browsers-and-operating-systems-support-lets-encrypt/4394 https://community.letsencrypt.org/t/which-browsers-and-opera...

by 0x0 11y ago

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.

EwanToo 11y ago

I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?

0x0 11y ago
Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.
- jhkaghjkga 11y ago
  That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
  - 0x0 11y ago
    That's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
- Tepix 11y ago
  Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.
  - 0x0 11y ago
    That doesn't help when you are targeting a market where Android 2.x is prevalent.
    - Tepix 11y ago
      True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?
      - 0x0 11y ago
        You'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).

DanielDent 11y ago

Windows XP & older Android releases are the two most common reasons to care about SNI. Let's Encrypt actually has compatibility issues with Windows XP, so wildcard certificates wouldn't help. https://community.letsencrypt.org/t/which-browsers-and-operating-systems-support-lets-encrypt/4394 https://community.letsencrypt.org/t/which-browsers-and-opera...