4 ms·

> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Let's Encrypt and certbot. It's all but trivial to SSL your s

> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Let's Encrypt and certbot. It's all but trivial to SSL your site and keep it up to date if you control the system. Here's how I SSLed my blogs. This was interactive, but fully scripting it would be easy: https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-enabled-how-to-do-this-yourself/ https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-... Took me literally minutes to set up, it took more time to track down the http:// http:// images to fix the mixed-content warning.

kuschku 10y ago
The entire argument is about sites where that is not possible. Lets Encrypt has a limit of 20 domains per week for you. So you end up with at most a few hundred users.
- EvilTerran 10y ago
  20 certificates per week, each cert can be for up to 100 subdomains via SANs; and that limit is only for new certs, renewals don't count towards it - so if you can batch your requests (eg, with an "it may take up to 12 hours for your site to become available over HTTPS" notice, then twice a day make one big cert request for all your new domains), you can get up to 2000 per week; and there's no hard limit to the number you can accumulate over time. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ If that's not enough for your use case, you're probably big enough that a wildcard cert is a negligible expense.
  - Dylan16807 10y ago
    No site should require a day's delay on an automated software thing that can be done in seconds. The limit remains at 20 per week if you want to provide a good experience. And that's not big.
    - EvilTerran 10y ago
      Sure, it's not ideal... but does it really matter? Just register your domain with this hypothetical service while you're still preparing the content for it, so there's time for the cert to go through before you need it. Or they could let you provide your own cert if you're in that much of a hurry. We're talking about edge-cases within edge-cases at this point: a service that (1) offers HTTPS subdomains (2) hasn't been able to get a rate-limit increase from Let's Encrypt (3) is unwilling to buy a wildcard cert (4) either is growing by hundreds of subdomains a day, or has a significant amount of clients who can't wait a few hours for a cert but won't buy their own. That's so oddly specific, I'm not surprised people aren't going out of their way to cater to it.
      - kuschku 10y ago
        That's so oddly specific, it's basically every hosted solution you could invent, ever. If I want to build my own little Github sites, I'd already run into the problem. And, in fact, I've run into the limits several times before, and had to use startssl certs for far longer than planned because of that.

kuschku 10y ago

The entire argument is about sites where that is not possible. Lets Encrypt has a limit of 20 domains per week for you. So you end up with at most a few hundred users.

EvilTerran 10y ago
20 certificates per week, each cert can be for up to 100 subdomains via SANs; and that limit is only for new certs, renewals don't count towards it - so if you can batch your requests (eg, with an "it may take up to 12 hours for your site to become available over HTTPS" notice, then twice a day make one big cert request for all your new domains), you can get up to 2000 per week; and there's no hard limit to the number you can accumulate over time. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ If that's not enough for your use case, you're probably big enough that a wildcard cert is a negligible expense.
- Dylan16807 10y ago
  No site should require a day's delay on an automated software thing that can be done in seconds. The limit remains at 20 per week if you want to provide a good experience. And that's not big.
  - EvilTerran 10y ago
    Sure, it's not ideal... but does it really matter? Just register your domain with this hypothetical service while you're still preparing the content for it, so there's time for the cert to go through before you need it. Or they could let you provide your own cert if you're in that much of a hurry. We're talking about edge-cases within edge-cases at this point: a service that (1) offers HTTPS subdomains (2) hasn't been able to get a rate-limit increase from Let's Encrypt (3) is unwilling to buy a wildcard cert (4) either is growing by hundreds of subdomains a day, or has a significant amount of clients who can't wait a few hours for a cert but won't buy their own. That's so oddly specific, I'm not surprised people aren't going out of their way to cater to it.
    - kuschku 10y ago
      That's so oddly specific, it's basically every hosted solution you could invent, ever. If I want to build my own little Github sites, I'd already run into the problem. And, in fact, I've run into the limits several times before, and had to use startssl certs for far longer than planned because of that.