3 ms·
We use wildcard certs for a number of domains to support affiliate subdomains. So affiliate.example.com and affiliate2.example.com are all served by the same se
by pilom 10y ago
We use wildcard certs for a number of domains to support affiliate subdomains. So affiliate.example.com and affiliate2.example.com are all served by the same servers and thus all need to validate with one cert.
- duaneb 10y agoYou can use SAN certificates to avoid wildcards while still validating for a number of domains. They don't even need to be subdomains.
- Johnny555 10y agoThere's a limit to how many SAN's you can fit in one cert. There is apparently no defined upper bound, but dependent on the client's implementation. 25 - 100 names seems to be the common limit supported by most registrars. In the parent poster's case, it sounds like a good use case for a wildcard cert. They may have thousands of affiliates, and may not know all of the affiliates ahead of time, so with a SAN cert, would need to reissue the certificate each time a new affiliate signs up. https://community.letsencrypt.org/t/subjectaltname-certificates/100/16 https://community.letsencrypt.org/t/subjectaltname-certifica...
- duaneb 10y agoOh, I completely agree—I maintain a SAN and it's a royal pain in the ass. But there are options, and a SAN has lower risk if your key is leaked (only the enumerated domains will validate).