8 ms·

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-certificates/258 https://co

by xutopia 10y ago

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-certificates/258 https://community.letsencrypt.org/t/please-support-wildcard-...

dimino 10y ago
I feel like this is one of those "faster horse" moments. You don't need a wildcard cert! Just get certs for each one of your subdomains, even internally.
- xutopia 10y ago
  I get where you're coming from but I depend on a subdomain for each one of my user signups and we're talking thousands. LE limits us to 100 subdomains on a single cert and would require a restart for each signup. I'll definitely be using LE for other projects but many use cases require wildcards.
  - tracker1 10y ago
    And most of those wildcard use cases are business sites/applications that can/should just buy a wildcard cert. That said, I wouldn't mind seeing better support for the freedns/dyndns subdomains.
- eeeeeeeeeeeee 10y ago
  Some people are using dynamic dns records, so the list of subdomains is not static. This is where wildcard ssl is perfect. And what if you have hundreds or thousands of subdomains? It unnecessarily bulks up your configuration as you have to do a cert per site instead of a single one.
devy 10y ago
It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issues/66#issuecomment-160487331 https://github.com/certbot/certbot/issues/66#issuecomment-16...
- Nullabillity 10y ago
  SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.
  - icebraining 10y ago
    A good example is the Sandstorm platform, which fits both cases.
  - aroch 10y ago
    Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.
    - kentonv 10y ago
      Well yes, that's the idea: Say you have a wildcard DNS entry and you cryptographically-randomly-generate hostnames in it, as an added layer of defense against CSRF bugs in the applications running on these hosts. https://docs.sandstorm.io/en/latest/administering/wildcard/#why-sandstorm-needs-wildcard-dns https://docs.sandstorm.io/en/latest/administering/wildcard/#...
      - aroch 10y ago
        That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind
        icebraining 10y ago
        > publish Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.
throwaway29464 10y ago
Check out GlobalSigns Cloud SSL product if you want a cert that can mix wildcards with top level SANs....not free but....https://www.globalsign.com/en/cloud/ https://www.globalsign.com/en/cloud/
- nsgi 10y ago
  Or AWS Certificate Manager for free if you use AWS.
mholt 10y ago
I spoke about this earlier this week at a meetup. The consensus in the group was that wildcard certificates are desirable because they're easier to manage. If your tooling is good, the automation afforded by ACME can invalidate the need for wildcard certificates.
- teraflop 10y ago
  The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages out to one certificate (which can include up to 100 hostnames) per roughly 8 hours, per domain. That's probably good enough for almost everyone who uses hostnames to represent physical machines or services. But it's totally unusable if you want to create certificates on the fly in response to user signups. [1]: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
  - deleted 10y ago
    [deleted]
  - foota 10y ago
    I'd imagine you might be able to reach out to them in that case.
  - hawkice 10y ago
    I deploy all the different little code projects I make to different domains and I've hit the Let's Encrypt rate limit. If (like me) you waited a couple months to secure these little side projects, you'll hit the rate limit too. That being said, I just waited a week -- now everything is secure.
  - mieko 10y ago
    This is the real issue with not allowing wildcard certs. If the rate limits were something that just cut in at abuse-levels, there'd be no need for them. Sites with per-user subdomains (to get security features like cookie isolation, break same-origin effects, etc) run into the limits really quickly, and must currently rely on a wildcard. I've been calling this "the tumblr scenario", but people seem to think there's a way around it without just using another CA.
GhotiFish 10y ago
This 100% blocked me. I tried to work around it by using lets encrypt to provision me certificates on the fly, but I got rate limited. Then I started speccing out a way to get single certs for many subdomains in one request using SAN, and the whole thing looked like it would require more development time compared to just buying a wildcard cert. Very frustrating.
- xienze 10y ago
  I mean it kind of makes sense doesn't it? If you need enough certs (> 20 per week) to hit the rate limit, you're probably running some sort of business -- in which case you probably shouldn't be depending on a free service and can likely afford the cost of wildcard certs.
  - greggman 10y ago
    I'm not running a business. I'm writing an open source library that needs certs because browsers are banning features unless served from https http://docs.happyfuntimes.net http://docs.happyfuntimes.net One cert per game * one hit game = need 10s of thousands of certs. But even without a hit game a single game jam would hit the limits For reference here is an example of a similar problem and solution but it required $$$$$$ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... PS: I know this is not a problem with Lets Encrypt. They are not trying to solve this problem. It is a problem that needs a cheaper solution at least for open source projects.
    - peteretep 10y ago
      > It is a problem that needs a cheaper solution at > least for open source projects. Maybe: games.example.com/foobarbarz instead of foobarbaz.example.com?
      - greggman 10y ago
        how would this help? Like Plex each game is running a local webserver on a user's home computer/apple tv/android tv/etc. It's those devices that need the certs in order to serve content to browsers on player's smartphones.
pfooti 10y ago
While there's reasons for wildcard support, I find the support for SAN and just many certs to be just fine in a lot of ways. I've purchased wildcard domains in the past mostly because it was more cost-effective than buying the individual mail, testing, www, and so on subdomains, especially if there's a cost associated with adding more subdomains later. Having a scriptable renewal process and no real cost associated with getting additional subdomains on the cert (besides operator time) covers some significant portion of the generalized need for wildcard domains. I know there's other reasons, sure. But it's definitely not stopping me.

by xutopia 10y ago

dimino 10y ago

I feel like this is one of those "faster horse" moments. You don't need a wildcard cert! Just get certs for each one of your subdomains, even internally.

xutopia 10y ago
I get where you're coming from but I depend on a subdomain for each one of my user signups and we're talking thousands. LE limits us to 100 subdomains on a single cert and would require a restart for each signup. I'll definitely be using LE for other projects but many use cases require wildcards.
- tracker1 10y ago
  And most of those wildcard use cases are business sites/applications that can/should just buy a wildcard cert. That said, I wouldn't mind seeing better support for the freedns/dyndns subdomains.
eeeeeeeeeeeee 10y ago
Some people are using dynamic dns records, so the list of subdomains is not static. This is where wildcard ssl is perfect. And what if you have hundreds or thousands of subdomains? It unnecessarily bulks up your configuration as you have to do a cert per site instead of a single one.

devy 10y ago

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issues/66#issuecomment-160487331 https://github.com/certbot/certbot/issues/66#issuecomment-16...

Nullabillity 10y ago
SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.
- icebraining 10y ago
  A good example is the Sandstorm platform, which fits both cases.
- aroch 10y ago
  Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.
  - kentonv 10y ago
    Well yes, that's the idea: Say you have a wildcard DNS entry and you cryptographically-randomly-generate hostnames in it, as an added layer of defense against CSRF bugs in the applications running on these hosts. https://docs.sandstorm.io/en/latest/administering/wildcard/#why-sandstorm-needs-wildcard-dns https://docs.sandstorm.io/en/latest/administering/wildcard/#...
    - aroch 10y ago
      That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind
      - icebraining 10y ago
        > publish Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.

throwaway29464 10y ago

Check out GlobalSigns Cloud SSL product if you want a cert that can mix wildcards with top level SANs....not free but....https://www.globalsign.com/en/cloud/ https://www.globalsign.com/en/cloud/

nsgi 10y ago
Or AWS Certificate Manager for free if you use AWS.

mholt 10y ago

I spoke about this earlier this week at a meetup. The consensus in the group was that wildcard certificates are desirable because they're easier to manage. If your tooling is good, the automation afforded by ACME can invalidate the need for wildcard certificates.

teraflop 10y ago
The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages out to one certificate (which can include up to 100 hostnames) per roughly 8 hours, per domain. That's probably good enough for almost everyone who uses hostnames to represent physical machines or services. But it's totally unusable if you want to create certificates on the fly in response to user signups. [1]: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
- deleted 10y ago
  [deleted]
- foota 10y ago
  I'd imagine you might be able to reach out to them in that case.
- hawkice 10y ago
  I deploy all the different little code projects I make to different domains and I've hit the Let's Encrypt rate limit. If (like me) you waited a couple months to secure these little side projects, you'll hit the rate limit too. That being said, I just waited a week -- now everything is secure.
- mieko 10y ago
  This is the real issue with not allowing wildcard certs. If the rate limits were something that just cut in at abuse-levels, there'd be no need for them. Sites with per-user subdomains (to get security features like cookie isolation, break same-origin effects, etc) run into the limits really quickly, and must currently rely on a wildcard. I've been calling this "the tumblr scenario", but people seem to think there's a way around it without just using another CA.

GhotiFish 10y ago

This 100% blocked me. I tried to work around it by using lets encrypt to provision me certificates on the fly, but I got rate limited. Then I started speccing out a way to get single certs for many subdomains in one request using SAN, and the whole thing looked like it would require more development time compared to just buying a wildcard cert. Very frustrating.

xienze 10y ago
I mean it kind of makes sense doesn't it? If you need enough certs (> 20 per week) to hit the rate limit, you're probably running some sort of business -- in which case you probably shouldn't be depending on a free service and can likely afford the cost of wildcard certs.
- greggman 10y ago
  I'm not running a business. I'm writing an open source library that needs certs because browsers are banning features unless served from https http://docs.happyfuntimes.net http://docs.happyfuntimes.net One cert per game * one hit game = need 10s of thousands of certs. But even without a hit game a single game jam would hit the limits For reference here is an example of a similar problem and solution but it required $$$$$$ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... PS: I know this is not a problem with Lets Encrypt. They are not trying to solve this problem. It is a problem that needs a cheaper solution at least for open source projects.
  - peteretep 10y ago
    > It is a problem that needs a cheaper solution at > least for open source projects. Maybe: games.example.com/foobarbarz instead of foobarbaz.example.com?
    - greggman 10y ago
      how would this help? Like Plex each game is running a local webserver on a user's home computer/apple tv/android tv/etc. It's those devices that need the certs in order to serve content to browsers on player's smartphones.

pfooti 10y ago

While there's reasons for wildcard support, I find the support for SAN and just many certs to be just fine in a lot of ways. I've purchased wildcard domains in the past mostly because it was more cost-effective than buying the individual mail, testing, www, and so on subdomains, especially if there's a cost associated with adding more subdomains later. Having a scriptable renewal process and no real cost associated with getting additional subdomains on the cert (besides operator time) covers some significant portion of the generalized need for wildcard domains. I know there's other reasons, sure. But it's definitely not stopping me.