4 ms·

There are legitimate use cases: for instance, a multi-tenant app that designates tenant by subdomain.

dijit 9y ago
I would argue that they're useful but not mandatory. Is having separate certs really that big of a deal? Operational overhead with LE is next to none and if you're scared of hitting limits you can contact LE to have the limits increased.
- minitech 9y ago
  Requesting a new certificate per user is another step that can go wrong, and contacting LE for limit increases is a barrier.
  - dijit 9y ago
    Isn't it less of a barrier than cert creation pre-LE? and you do it once.
    - simias 9y ago
      Pre-LE you'd use an other authority that provided wildcard certificates. That's what they're for after all, why would you want to hack your way around them?
maccard 9y ago
Couldn't you have a cert per sub domain? If you're using Let's encrypt, you almost certainly have automated renewal in place, so you could allocate a cert when you give them a subdomain
- ceejayoz 9y ago
  You can only put 100 domains on a Let's Encrypt cert, so if you're a site like Tumblr that's going to be a whole bunch (hundreds of thousands or millions of certs) of mayhem.
  - maccard 9y ago
    You can contact Let's Encrypt to get those limits lifted I believe?
    - ceejayoz 9y ago
      That's not going to help. Every time someone adds a domain to Tumblr, they'd have to re-do the certbot challenges for all 50 MILLION domains. Plus, all 50 million domains are listed IN the certificate. It'd be megabytes worth of additional data for every visitor to Tumblr. *.tumblr.com makes a lot more sense.
      - Whitestrake 9y ago
        I agree with the case for using a wildcard, but just to play devil's advocate - why can't they take the CloudFlare approach? Generate a cert for 100 of your client's domains, use that cert across those domains. Cut your 50m domains down to 500,000 certificates. Serving the right certificate for the right domain is a simple enough task. As new tumblr domains are registered, generate more certs in batches of 100 domains. I doubt anyone would ever seriously suggest putting millions of SANs on a single certificate, but 100 isn't too farfetched.
        voltagex_ 9y ago
        This seems to be how wordpress.com does it.
        ceejayoz 9y ago
        They appear to have a wildcard for the *.wordpress.com subdomains, though.
calafrax 9y ago
Absolutely. I use a wildcard for this and doing a cert for each sub would just be a lot of hassle and potential for things to go wrong with no security benefit.
- bryanlarsen 9y ago
  I use kubernetes-lego for this and it's all automatic, zero hassle.
  - calafrax 9y ago
    That is a good solution for kube thanks for the reference. My situation is a bit different: hosting a bunch of subs on the same servers. With one wildcard I have one server conf with one cert and use the hostname to rewrite each request to the correct directory. If I did a cert for each sub the nginx conf would need 1000's of server config blocks each with its own cert. I haven't tested, so maybe nginx would handle this just fine, but it is easier to just go with a single wildcard and not worry about it. As far as I can tell there is no security advantage to having multiple certs instead of one wildcard since I would have all the certs on the same server anyway but if anyone knows of any I would be happy to hear.

I would argue that they're useful but not mandatory. Is having separate certs really that big of a deal? Operational overhead with LE is next to none and if you're scared of hitting limits you can contact LE to have the limits increased.

minitech 9y ago
Requesting a new certificate per user is another step that can go wrong, and contacting LE for limit increases is a barrier.
- dijit 9y ago
  Isn't it less of a barrier than cert creation pre-LE? and you do it once.
  - simias 9y ago
    Pre-LE you'd use an other authority that provided wildcard certificates. That's what they're for after all, why would you want to hack your way around them?

maccard 9y ago

Couldn't you have a cert per sub domain? If you're using Let's encrypt, you almost certainly have automated renewal in place, so you could allocate a cert when you give them a subdomain

ceejayoz 9y ago
You can only put 100 domains on a Let's Encrypt cert, so if you're a site like Tumblr that's going to be a whole bunch (hundreds of thousands or millions of certs) of mayhem.
- maccard 9y ago
  You can contact Let's Encrypt to get those limits lifted I believe?
  - ceejayoz 9y ago
    That's not going to help. Every time someone adds a domain to Tumblr, they'd have to re-do the certbot challenges for all 50 MILLION domains. Plus, all 50 million domains are listed IN the certificate. It'd be megabytes worth of additional data for every visitor to Tumblr. *.tumblr.com makes a lot more sense.
    - Whitestrake 9y ago
      I agree with the case for using a wildcard, but just to play devil's advocate - why can't they take the CloudFlare approach? Generate a cert for 100 of your client's domains, use that cert across those domains. Cut your 50m domains down to 500,000 certificates. Serving the right certificate for the right domain is a simple enough task. As new tumblr domains are registered, generate more certs in batches of 100 domains. I doubt anyone would ever seriously suggest putting millions of SANs on a single certificate, but 100 isn't too farfetched.
      - voltagex_ 9y ago
        This seems to be how wordpress.com does it.
        ceejayoz 9y ago
        They appear to have a wildcard for the *.wordpress.com subdomains, though.

calafrax 9y ago

Absolutely. I use a wildcard for this and doing a cert for each sub would just be a lot of hassle and potential for things to go wrong with no security benefit.

bryanlarsen 9y ago
I use kubernetes-lego for this and it's all automatic, zero hassle.
- calafrax 9y ago
  That is a good solution for kube thanks for the reference. My situation is a bit different: hosting a bunch of subs on the same servers. With one wildcard I have one server conf with one cert and use the hostname to rewrite each request to the correct directory. If I did a cert for each sub the nginx conf would need 1000's of server config blocks each with its own cert. I haven't tested, so maybe nginx would handle this just fine, but it is easier to just go with a single wildcard and not worry about it. As far as I can tell there is no security advantage to having multiple certs instead of one wildcard since I would have all the certs on the same server anyway but if anyone knows of any I would be happy to hear.