3 ms·
You can use SAN certificates to avoid wildcards while still validating for a number of domains. They don't even need to be subdomains.
by duaneb 10y ago
You can use SAN certificates to avoid wildcards while still validating for a number of domains.
They don't even need to be subdomains.
- Johnny555 10y agoThere's a limit to how many SAN's you can fit in one cert. There is apparently no defined upper bound, but dependent on the client's implementation. 25 - 100 names seems to be the common limit supported by most registrars. In the parent poster's case, it sounds like a good use case for a wildcard cert. They may have thousands of affiliates, and may not know all of the affiliates ahead of time, so with a SAN cert, would need to reissue the certificate each time a new affiliate signs up. https://community.letsencrypt.org/t/subjectaltname-certificates/100/16 https://community.letsencrypt.org/t/subjectaltname-certifica...
- duaneb 10y agoOh, I completely agree—I maintain a SAN and it's a royal pain in the ass. But there are options, and a SAN has lower risk if your key is leaked (only the enumerated domains will validate).