4 ms·

The official advice from LE about many subdomains is to combine them onto one cert with Subject Alternative Names. This doesn't work for me - I used to do this

The official advice from LE about many subdomains is to combine them onto one cert with Subject Alternative Names. This doesn't work for me - I used to do this with the Lego client using the DNS challenge for my registrar, Namecheap. Unfortunately by the second or third challenge it would hang and eventually give up. I didn't have the problem splitting the subdomains into seperate certs and running them 5 minutes apart. The problem is likely in over restrictive rate limiting from Namecheap, but either way one of them needs to loosen up. Does anybody else know about the Namecheap restrictions? I don't use their API for anything else but the LE DNS challenge (adding TXT records once every other month)

pfg 10y ago
If Namecheap sends a specific HTTP Status Code or a header like Retry-After when it performs rate limiting, this could probably be fixed in the lego DNS provider code for Namecheap. Do you happen to have any logs from when this happens? (Not sure how verbose the logging is and whether that information would be included, but it's worth a shot.)
- sofaofthedamned 10y ago
  I don't i'm afraid but I will try and pull one this weekend. Only reason I didn't do this previously is i'm pretty confident it's a Namecheap issue so i'd rather not bug the LEGO devs about it if so.
bigiain 10y ago
" … one of them needs to loosen up." Or perhaps you need to revisit your decision to require "many subdomains" and consider whether it's a sensible decision if it relies on somebody else providing SSL certs for them inexpensively or for free. You can buy a wildcard cert for under a hundred bucks these days - how much obligation do you think LetsEncrypt have to change their product to save you $100/year because of your design decisions? If LetsEncrypt (or Namecheap) don't work for you, pay someone who sells a thing that _does_ work for you (or change your requirements).
- sofaofthedamned 10y ago
  Er, hang on, I don't have a sense of entitlement about this and if it came across that way it wasn't intended. Point is, I had only 8 domains on the cert and it didn't manage to complete most of the time. It's either an issue with the LEGO client, LE or Namecheap API.

pfg 10y ago

If Namecheap sends a specific HTTP Status Code or a header like Retry-After when it performs rate limiting, this could probably be fixed in the lego DNS provider code for Namecheap. Do you happen to have any logs from when this happens? (Not sure how verbose the logging is and whether that information would be included, but it's worth a shot.)

sofaofthedamned 10y ago
I don't i'm afraid but I will try and pull one this weekend. Only reason I didn't do this previously is i'm pretty confident it's a Namecheap issue so i'd rather not bug the LEGO devs about it if so.

bigiain 10y ago

" … one of them needs to loosen up." Or perhaps you need to revisit your decision to require "many subdomains" and consider whether it's a sensible decision if it relies on somebody else providing SSL certs for them inexpensively or for free. You can buy a wildcard cert for under a hundred bucks these days - how much obligation do you think LetsEncrypt have to change their product to save you $100/year because of your design decisions? If LetsEncrypt (or Namecheap) don't work for you, pay someone who sells a thing that _does_ work for you (or change your requirements).

sofaofthedamned 10y ago
Er, hang on, I don't have a sense of entitlement about this and if it came across that way it wasn't intended. Point is, I had only 8 domains on the cert and it didn't manage to complete most of the time. It's either an issue with the LEGO client, LE or Namecheap API.