6 ms·

Well, you can't do wildcard certs, which is fine for most businesses, but for some it's a non-starter. That doesn't make LE bad, of course, it just means it's

Well, you can't do wildcard certs, which is fine for most businesses, but for some it's a non-starter. That doesn't make LE bad, of course, it just means it's not the appropriate tool for all use cases.

leeoniya 10y ago
but certs dont cost anything. you can easily automate the renewal of as many subdomain certs as needed.
- brianwawok 10y ago
  If you are a big company and need say 100k wildcard certs (say one per client).. I am pretty sure I can justify spending $50 for a wildcard cert vs a fleet of servers and engineers and monitors to enforce let's encrypt work. Let's encrypt is great but let's not pretend it's the right solution for all websites.
  - leeoniya 10y ago
    LE should charge a small fee for wildcard certs and extended validity periods (up to some reasonable limit). They'd likely cover their operating budget very quickly. What's their stance on wildcard certs with SANs? Is it simply too risky / ripe for abuse?
    - mjevans 10y ago
      Absolutely no knowledge here, but my /guess/ has been that they don't do more because it would either require more effort or would have soured the cross-signing deal so that they'd be validated by a CA that's already in older operating systems/devices.
    - yjftsjthsd-h 10y ago
      I suspect they will never allow longer validity certs because they want renewal to be automated.
    - sandGorgon 10y ago
      I will a LOT if LE can issue wildcard certificates to me with a 3 year validity. And send me reminder emails when im nearing expiry.
- tyingq 10y ago
  There is some time, scripting, etc, cost to integrating lots of certs into a single instance of Apache, nginx, etc. Wildcards certs have value in some settings.
- simcop2387 10y ago
  Not always possible in all scenarios. For a setup like github.io and github pages it'd be difficult for LE to handle so many domains. Or any scenario where you serve a subdomain up without knowing ahead of time what it'll be (say a tor relay service) it's just not feasible.
  - kbenson 10y ago
    What's the turnaround time for LE? Could you possibly deneract an LE certificate on the fly as needed when the request is sent (just block until it's present to be served)? Not that I would really suggest this, it's a DOS waiting to happen.
    - josegonzalez 10y ago
      Dokku can do it in [two commands](https://github.com/dokku/dokku-letsencrypt#usage https://github.com/dokku/dokku-letsencrypt#usage): dokku config:set --no-restart myapp DOKKU_LETSENCRYPT_EMAIL=mail@example.com dokku letsencrypt app
      - Xorlev 10y ago
        The problem is the volume of certs needed, not the simplicity of LE for the smaller usecase.
    - Lxr 10y ago
      There're limits to the amount of subdomain certs you can request, so I imagine this wouldn't work. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ > Combined with the above limit, that means you can issue certificates containing up to 2,000 unique subdomains per week.
  - tajen 10y ago
    LetsEncrypt's software is open-source. A commercial CA could use it, remove the limits and add EV if they wanted, then lower their costs to $50 per domain: much lower and much more trustworthy than Symantec...
- protomyth 10y ago
  If your vendor supports those certificates. I am amazed by the amount of software from government contracts or the education field that specify certain certificate vendors. I have two required vendors (government vendor software specified by grant) that require one of three certificate vendors. I am not pleased, but not a real lot I can do.
- geofft 10y ago
  1. Let's Encrypt has fairly stringent rate limits: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ You can only get up to 2000 subdomains per week (20 certs * 100 names per cert). If you want to provision a large site, this might be way too small. For instance, my college computer club ran a web hosting service that offered everyone a $username.webhost.example.edu hostname, and there are well more than 2000 active users. So it would be a multi-week process to issue all the certs. GitHub, for instance, has three million users. Provisioning a cert for each github.io domain would take 29 years. Yes, you can contact LE and ask for a limit increase, but three million certs would still spam the public cert transparency logs, LE's internal records, etc. significantly. That is a cost. LE rounds down the cost of an individual cert, even 20 certs per week, to zero, but the cost of three million certs is very nonzero. 2. Wildcards work in mass-hosting situations where individual certs don't. Again, for my college computer club's server, putting a few thousand <VirtualHost> blocks in Apache's configuration makes it take forever to start. I tried this. It was a bad plan. The better plan is mass-hosting tools like mod_vhost_ldap or even RewriteRules based on the hostname, but they don't let you interact with SNI, because as far as Apache (and thus mod_ssl) see, it's just a single <VirtualHost>. 3. In order to issue a cert, you need to publicly respond for the name on the cert. If you're issuing public-CA certs for private-network websites (which is generally a best practice over running an enterprise CA), you need to briefly configure a DNS entry for the private name to respond to either the DNS challenge or the HTTP challenge. You can't just configure a DNS entry internally. So your internal deployment process now involves updating public DNS. For anyone who's not running publicly-facing infrastructure (i.e., most companies, whose public Internet presence is just a website), there may not even be an automated means of updating public DNS. A wildcard cert, meanwhile, will just email the owner of the registered domain via e.g. WHOIS contact info, which requires no external configuration, and is a one-time setup process. Everything else is internal at that point. I love Let's Encrypt, but it's ill-suited to use cases where wildcards are popular.
  - deleted 10y ago
    [deleted]
  - feld 10y ago
    Why didn't you use the classic webserver.example.edu/~$username ? Your current implementation would be a nightmare to admin in comparison

leeoniya 10y ago

but certs dont cost anything. you can easily automate the renewal of as many subdomain certs as needed.

brianwawok 10y ago
If you are a big company and need say 100k wildcard certs (say one per client).. I am pretty sure I can justify spending $50 for a wildcard cert vs a fleet of servers and engineers and monitors to enforce let's encrypt work. Let's encrypt is great but let's not pretend it's the right solution for all websites.
- leeoniya 10y ago
  LE should charge a small fee for wildcard certs and extended validity periods (up to some reasonable limit). They'd likely cover their operating budget very quickly. What's their stance on wildcard certs with SANs? Is it simply too risky / ripe for abuse?
  - mjevans 10y ago
    Absolutely no knowledge here, but my /guess/ has been that they don't do more because it would either require more effort or would have soured the cross-signing deal so that they'd be validated by a CA that's already in older operating systems/devices.
  - yjftsjthsd-h 10y ago
    I suspect they will never allow longer validity certs because they want renewal to be automated.
  - sandGorgon 10y ago
    I will a LOT if LE can issue wildcard certificates to me with a 3 year validity. And send me reminder emails when im nearing expiry.
tyingq 10y ago
There is some time, scripting, etc, cost to integrating lots of certs into a single instance of Apache, nginx, etc. Wildcards certs have value in some settings.
simcop2387 10y ago
Not always possible in all scenarios. For a setup like github.io and github pages it'd be difficult for LE to handle so many domains. Or any scenario where you serve a subdomain up without knowing ahead of time what it'll be (say a tor relay service) it's just not feasible.
- kbenson 10y ago
  What's the turnaround time for LE? Could you possibly deneract an LE certificate on the fly as needed when the request is sent (just block until it's present to be served)? Not that I would really suggest this, it's a DOS waiting to happen.
  - josegonzalez 10y ago
    Dokku can do it in [two commands](https://github.com/dokku/dokku-letsencrypt#usage https://github.com/dokku/dokku-letsencrypt#usage): dokku config:set --no-restart myapp DOKKU_LETSENCRYPT_EMAIL=mail@example.com dokku letsencrypt app
    - Xorlev 10y ago
      The problem is the volume of certs needed, not the simplicity of LE for the smaller usecase.
  - Lxr 10y ago
    There're limits to the amount of subdomain certs you can request, so I imagine this wouldn't work. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ > Combined with the above limit, that means you can issue certificates containing up to 2,000 unique subdomains per week.
- tajen 10y ago
  LetsEncrypt's software is open-source. A commercial CA could use it, remove the limits and add EV if they wanted, then lower their costs to $50 per domain: much lower and much more trustworthy than Symantec...
protomyth 10y ago
If your vendor supports those certificates. I am amazed by the amount of software from government contracts or the education field that specify certain certificate vendors. I have two required vendors (government vendor software specified by grant) that require one of three certificate vendors. I am not pleased, but not a real lot I can do.
geofft 10y ago
1. Let's Encrypt has fairly stringent rate limits: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ You can only get up to 2000 subdomains per week (20 certs * 100 names per cert). If you want to provision a large site, this might be way too small. For instance, my college computer club ran a web hosting service that offered everyone a $username.webhost.example.edu hostname, and there are well more than 2000 active users. So it would be a multi-week process to issue all the certs. GitHub, for instance, has three million users. Provisioning a cert for each github.io domain would take 29 years. Yes, you can contact LE and ask for a limit increase, but three million certs would still spam the public cert transparency logs, LE's internal records, etc. significantly. That is a cost. LE rounds down the cost of an individual cert, even 20 certs per week, to zero, but the cost of three million certs is very nonzero. 2. Wildcards work in mass-hosting situations where individual certs don't. Again, for my college computer club's server, putting a few thousand <VirtualHost> blocks in Apache's configuration makes it take forever to start. I tried this. It was a bad plan. The better plan is mass-hosting tools like mod_vhost_ldap or even RewriteRules based on the hostname, but they don't let you interact with SNI, because as far as Apache (and thus mod_ssl) see, it's just a single <VirtualHost>. 3. In order to issue a cert, you need to publicly respond for the name on the cert. If you're issuing public-CA certs for private-network websites (which is generally a best practice over running an enterprise CA), you need to briefly configure a DNS entry for the private name to respond to either the DNS challenge or the HTTP challenge. You can't just configure a DNS entry internally. So your internal deployment process now involves updating public DNS. For anyone who's not running publicly-facing infrastructure (i.e., most companies, whose public Internet presence is just a website), there may not even be an automated means of updating public DNS. A wildcard cert, meanwhile, will just email the owner of the registered domain via e.g. WHOIS contact info, which requires no external configuration, and is a one-time setup process. Everything else is internal at that point. I love Let's Encrypt, but it's ill-suited to use cases where wildcards are popular.
- deleted 10y ago
  [deleted]
- feld 10y ago
  Why didn't you use the classic webserver.example.edu/~$username ? Your current implementation would be a nightmare to admin in comparison