4 ms·

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of cer

by zzzcpan 10y ago

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

Freaky 10y ago
Yep. You can get 20 different certificates per domain per week, with up to 100 names on each. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
tracker1 10y ago
If you're generating that many subdomains (and you control the subdomains), it's probably worth investing in a traditional wildcard cert. Though, it would be nice if the likes of dyndns names were given exception, since they are effectively second level tld's.
- mieko 10y ago
  LE uses the Public Suffix List to decide what's a "domain". Their really-low rate limits have caused a flood of applications which are overwhelming the PSL's maintainers. https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns-support/883/16 https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns...
perlgeek 10y ago
Though if you are a hosting provider for example, I'm sure you could try to negotiate a deal with let's encrypt for more tolerant rate limits for a bit of sponsoring.
- jaas 10y ago
  We do, in limited cases for large providers (we can only handle so many requests), adjust rate limits. Such adjustments are never dependent on sponsorship, though sponsorship is nice.
ocdtrekkie 10y ago
Wildcard certs are also a huge need for platforms like Sandstorm.io which opens documents on arbitrary/randomly-generated subdomains. And as someone who hosts a lot of things on various subdomains in general, the idea of having a bunch of different certs is far less appealing than a wildcard cert. But unfortunately it doesn't seem like Let's Encrypt currently has any plans to add wildcard certs any time soon.
theandrewbailey 10y ago
It sounds like you are doing something serious enough that Let's Encrypt might not meet your needs in other ways. Pay up for a wildcard cert or refactor subdomains out of your architecture.

by zzzcpan 10y ago

Freaky 10y ago

Yep. You can get 20 different certificates per domain per week, with up to 100 names on each. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

tracker1 10y ago

If you're generating that many subdomains (and you control the subdomains), it's probably worth investing in a traditional wildcard cert. Though, it would be nice if the likes of dyndns names were given exception, since they are effectively second level tld's.

mieko 10y ago
LE uses the Public Suffix List to decide what's a "domain". Their really-low rate limits have caused a flood of applications which are overwhelming the PSL's maintainers. https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns-support/883/16 https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns...

perlgeek 10y ago

Though if you are a hosting provider for example, I'm sure you could try to negotiate a deal with let's encrypt for more tolerant rate limits for a bit of sponsoring.

jaas 10y ago
We do, in limited cases for large providers (we can only handle so many requests), adjust rate limits. Such adjustments are never dependent on sponsorship, though sponsorship is nice.

ocdtrekkie 10y ago

Wildcard certs are also a huge need for platforms like Sandstorm.io which opens documents on arbitrary/randomly-generated subdomains. And as someone who hosts a lot of things on various subdomains in general, the idea of having a bunch of different certs is far less appealing than a wildcard cert. But unfortunately it doesn't seem like Let's Encrypt currently has any plans to add wildcard certs any time soon.

theandrewbailey 10y ago

It sounds like you are doing something serious enough that Let's Encrypt might not meet your needs in other ways. Pay up for a wildcard cert or refactor subdomains out of your architecture.