20 ms·
ACME v2 and Wildcard Certificate Support is Live
- brightball 9y agoCan this be used for multi-level subdomains? Like *.subdomain.example.org?
- ShakataGaNai 9y agoNo, but that limitation is due to wildcard certificates specifications - not LE.
- brightball 9y agoI'm mainly just trying to solve an issue where I've got end users who think there's a security problem because they've typed www.myorg.example.org instead of myorg.example.org and the wildcard DNS entry in Route53 picks it up...which directs the user to an Insecure error. Trying to figure out how to get Route53 to stop the wildcard at the top level or get a wildcard cert that will go down the path.
- stevekemp 9y agoYes in the literal sense you could have certificates like: *.internal.example.com *.external.example.com But no in the sense that you were asking, where you'd want to register certificate for multi-level wildcard: *.*.example.com
- deleted 9y ago[deleted]
- cm2187 9y agoAnd before you ask you can also do multi wildcard certificates. Like a single certificate for both *.example1.com and *.example2.com (using SAN).
- Jaruzel 9y agoOne of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's automatically trusted by all platforms and browsers[2]. For some companies that's going to be a BIG cost and resources saving. -- [1] but not actually used for any public facing services. [2] Mostly...
- Jaruzel 9y agoGoing to reply to my own comment here. It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.
- EvanAnderson 9y agoThe ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.
- Jaruzel 9y agoUnless of course, you are running Exchange. In which case it's not supported :(
- EvanAnderson 9y agoUnfortunately, yes. I've been lucky enough to be able to get domain renames done in Exchange 2003 environments (which is supported) or in non-Exchange environments. Migrating to a new domain because of a poorly-chosen name is a real pain. (I have one Customer who has a "." in their NetBIOS domain name. That creates some interesting kinds of hell-- completely breaks the NPS RADIUS server in Windows 2012.)
- johnr2 9y ago> Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. This. A long thread mostly advocating HTTPS everywhere and only one mention of this. Would any of the knowledgeable HTTPS advocates here care to comment on it?
- sheraz 9y agoGreat news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?
- dkasper 9y agoYeah, there are some edge cases where a wildcard is less secure. https://security.stackexchange.com/questions/8210/what-vulnerabilities-could-be-caused-by-a-wildcard-ssl-cert https://security.stackexchange.com/questions/8210/what-vulne...
- artursapek 9y agoIt's not even about edge cases - it's just good security practice to isolate credentials as much as possible and limit their scope.
- orthecreedence 9y agoYeah, I think that if someone hacked your DNS provider, they could add secure-payments.yourbusiness.com and start spamming people with "late payment! enter your credit card!" notices or something. So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?
- kardos 9y agoNot sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away
- orthecreedence 9y agoI think it's somewhat difficult to get a valid (CA-valid) certificate for a domain you don't own, though. At least, that's what the job of the CAs is: to verify that the certs they're issuing are for the actual owner of yourbusiness.com.
- neals 9y agoThe amount of money I've paid for this... I recon some of these providers are going under soon?
- nkkollaw 9y agoIf it was up to me, even right now. This is great news!
- shawabawa3 9y ago> I recon some of these providers are going under soon? I really hope so. The cost to providers is exactly the same for a wildcard and a standard certificate, and yet they costs hundreds of dollars. It's unbelievable it's lasted this long
- hamandcheese 9y agoIt’s not that unbelievable, what software service are you aware of that is sold at only it’s marginal cost?
- staticfish 9y agoIt's not "software" in the historic sense, like buying Photoshop or a paying for hosted Slack service. It's literally a command to generate a certificate from their root CA chain. Yes there's obviously business costs, and they have to employ people to do verification, etc (which they often do a terrible job at), but I think you see what the parent is getting at..
- Paul-ish 9y agoWhy hasn't competition reduced the price?
- eric_b 9y agoI'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).
- urda 9y agoThis is great news! Let's Encrypt has helped me secure many of my own boxes without having to maintain my own CA, very happy to see them grow.
- kyledrake 9y agoFirst, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lot of us are also using custom v1 code for various reasons that may not be easy to change. The preferable end-of-life date for ACMEv1 (sparing any existential security issues) should be never. Otherwise you will be executing a Geocities-sized web meltdown every time you phase out a version of the API.
- deleted 9y ago[deleted]
- wereHamster 9y agoDepends only on how much different v2 is from v1.
- mholt 9y ago> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.
- eric_b 9y agoThe SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren't. (Related, a big thanks to Google for un-trusting that whole big Symantec security chain. Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security, as I don't have nation states or motivated hackers in my threat model.) Security measures should be weighed like everything else - as cost/benefit. In many cases the cost of the security is not worth it. Edit: I'd just like to point out the irony in some of the replies to this comment. I'm complaining about zealotry, and the vast majority of nasty replies I've received to this comment are using language that only zealots and ideologues would use. My god, you'd think I'm killing puppies based on some of these responses. Nope, just advocating for using HTTPS where it makes sense, and not having it forced down your throat.
- thinkloop 9y agoOn the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved
- mholt 9y agoFrom the CA's perspective or the subscriber's perspective?
- thinkloop 9y agoI was wondering from let's encrypt's perspective, it has taken years to develop, and I know there is good reason for that, I just can't put my finger on what exactly those reasons are.
- kardos 9y agoDynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK [1] https://www.dtdns.com/dtsite/faq#hostdomains https://www.dtdns.com/dtsite/faq#hostdomains
- crtasm 9y agoLE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.
- kardos 9y agoYeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.
- crtasm 9y agoAlso a large majority of them will be on the public suffix list, which LE uses in their rate limiting checks. https://en.m.wikipedia.org/wiki/Public_Suffix_List https://en.m.wikipedia.org/wiki/Public_Suffix_List
- 0x0 9y agoDNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
- mholt 9y agoThe good news is that most of the major providers already have integrations into clients like lego: https://github.com/xenolf/lego/tree/master/providers/dns https://github.com/xenolf/lego/tree/master/providers/dns
- blattimwind 9y agoI never understood why DNS providers are so reluctant to offer standards-based access, like nsupdate(1). It's easy to set up, it can do everything, it's secure, requires no custom anything and it just works.
- vertex-four 9y agoOne option is to run your own BIND instance configured however you like, and pay for one or more secondary DNS services to sync off it. You can even hide your own BIND instance from everyone outside your network and just point your NS records at the secondaries, if you’re worried about misconfiguration/DoS attacks/etc.
- jsmthrowaway 9y agoA perfectly viable option that is called 'shadow mastering'. dns.he.net lets you do it for free.
- zaarn 9y agoThat sounds interesting. Would you know of any secondary DNS service headquartered in Europe? I always wanted to host DNS myself but since I lack a secondary DNS...
- vertex-four 9y ago
- rospaya 9y agoCan anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
- ocdtrekkie 9y agoThe only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for many reasons.
- gnarcoregrizz 9y agoit's possibly a good target for decentralization + multisig. decentralization so a CA never "goes down", multisig so that a certificate needs N signers, thus if a private key gets hacked then the cert isn't compromised. the hard part seems to be verifying the ownership and integrating with the existing web (the oracle problem)
- elahd 9y agoThe encryption part is easy -- you don't need CAs for that -- but they're a necessary evil when it comes to verifying ownership. You need to delegate trust to someone, otherwise using the internet becomes too cumbersome.
- ocdtrekkie 9y agoAutomated SSL providers effectively mitigate the idea of "verifying ownership" or "delegating trust", because for example, someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid". We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. (In this example, bear in mind, Google doesn't use an EV cert, so they'd be equally valid to a web browser. And a lot of EV certs I believe are getting distrusted soon as it is.) CAs seem like a system that really doesn't work today, we've seen multiple times that many of these CAs aren't worth delegating trust to to begin with, and it causes an unnecessary cost and burden upon just... encrypting traffic.
- Santosh83 9y agoI do hope GitHub employs this for rolling out https for Pages sites using custom domains too.
- apearson 9y agoNot sure if it would help in your situation but I've moved all of my github pages to netlify.com and they have a one button https feature for custom domains.
- mattwoodnyc 9y agoI did the same. Between Netlify and Zeit.co's Now, I don't see any reason to complain about HTTPS, not to mention the devOps issues that both these services solve. SSL requires one click with Netlify, and it's on by default with Now.
- deleted 9y ago[deleted]
- apearson 9y agoBtw the only problem I have with Netlify is the close name conflict with netflix. Chrome's autocomplete is completely confused.
- captncraig 9y agoNot Let's Encrypt, but you can run behind cloudflare's free plan for https.
- snowwolf 9y agoWhy do they need to support Wildcard Certificates for this? They have already starting rolling out https for custom domain GitHub Pages using LetsEncrypt - check your settings for an Enforce HTTPS option. All my GitHub Pages have it now.
- Santosh83 9y ago
- jack_jennings 9y agoNow here's to hoping that Heroku supports this soon. That will to mean I can a last migrate a number of apps that require wildcard domains to their platform.
- mbaha 9y agoI have a feeling they've been working on this. Their https support has always been top notch!
- snowwolf 9y agoI'm intrigued. What kind of app that you could host on heroku requires wildcard certificates? Bearing in mind that heroku can't really support wildcard subdomains for a single app. Each custom subdomain for an app needs to be added to the app. And then if you enable Automated Certificate Management for the app (which uses LetsEncrypt under the covers), they'll happily fetch a cert for each listed subdomain. And Heroku already supports wildcard certs (that you need to provide yourself) if you use the SSL addon.
- imrankhan2601 9y agoThe only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for many reasons. http://www.podinatutorials.com/ http://www.podinatutorials.com/
- anubhavmishra 9y agoThank you letsencrypt team! Really appreciate all the hardwork to get this out.
- Manozco 9y agoI did not see it on the forum, but seeing that the wildcard feature requires DNS-01 challenge for getting the certificates, does it mean automatic renewal is impossible without DNS api ? (or is it possible to renew without the dns challenge ? )
- hyperion2010 9y agoThis thread [0] suggests that you do. 0. https://www.reddit.com/r/programming/comments/84607r/lets_encrypt_releases_support_for_wildcard/dvn98d9/?st=jeq8o34j&sh=427b89e8 https://www.reddit.com/r/programming/comments/84607r/lets_en...
- schoen 9y agoYes, for an unattended renewal you'll need a way of programmatically creating TXT records. (Note that the validation follows CNAMEs, so the records you create don't have to be in your main DNS zone.)
- inetknght 9y agoThis whitepages unless you disable javascript or enable connections to discourse.org. How disappointing.
- kuon 9y agoThis is great, congrats, you are really doing a great service to the community.
- NKCSS 9y agoI just wished there was a Windows client that just works with IIS. Every time I try, it just errors out and gives me headaches (certify, Let's Encrypt Simple Windows Client, etc.)
- cm2187 9y agoIf you are using wildcard it doesn't need to be integrated with IIS. Use acmesharp which has a nice powershell interface (doesn't support wildcards yet). Then loading the certificate in the certificate store and assigning it to a website should be fairly easy in powershell.
- NKCSS 9y agoNah, I use a lot of SAN certificates; e.g. when a customer has 10 domains, and you want all of them to redirect to one, you have 1 site with just an SSL binding, and 1 site with all other domains and the non-SSL binding. That's a scenario that f's up a lot.
- peterwwillis 9y agoDoes the DNS method require proving you control the IP space for the domain, or is a DNS TXT really the only thing you need to generate a certificate?
- schoen 9y agoJust a TXT record. https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-7.4 https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-...
- peterwwillis 9y agoWow. A lot of sites are going to get owned.
- schoen 9y agoWe've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.
- peterwwillis 9y agoWithout verifying who controls the IP space? If you don't verify who controls the IP space, then if you can control the DNS, you can generate certs. Certs that appear valid to unsuspecting users. Putting that kind of trust in DNS is pretty crazy considering how insecure most DNS setups are. Not to mention general attacks on DNS. There's even a potential chicken and egg problem, if you need DNS to secure your HTTPS, but you use HTTPS to manage your DNS. What's really crazy too is it seems like this can't even be avoided. Even if I'm not using Let's Encrypt, if someone owns my DNS, they can use Let's Encrypt to get valid certs for my domain. That's insane. What am I missing here?
- cbo100 9y ago> What am I missing here? If I "own your DNS" wouldn't I just change them all to an IP space I control anyway? (If that was a requirement). Unless I'm missing something, requiring "owning the IP space" seems to be an impossible requirement to fulfil. I'm on a virtual host in Azure/AWS/Linode I have no way of proving I own the IP (because I don't).
- komuW 9y agoShameless plug, I created sewer[1], which is a letsencrypt client that you can use both as a (minimalistic) python library or as a command line application. And I just added ACME v2 support. Check it out, 1. https://github.com/komuw/sewer https://github.com/komuw/sewer
- kbuck 9y agoThanks for this; I've been searching for something similar for a while now. I'll look forward to trying it!
- massaman_yams 9y agoFor anyone wondering how to actually obtain a wildcard cert this way, here's the quick version: 1. Use acme.sh: https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh acme.sh --issue -d *.example.com --dns If your DNS provider has a supported api, you may be able to automatically publish the DNS records required using a slightly different command - see here: https://github.com/Neilpang/acme.sh/tree/master/dnsapi https://github.com/Neilpang/acme.sh/tree/master/dnsapi
- b3lvedere 9y agoThanks! This looks awesome. Can i automate it as well? I have been toying a little with wildcard using certbot on my Ubuntu OpenVPN appliance, but was a bit unsuccessful at the moment. Maybe i should just try and build a very tiny virtual sever that does nothing but spit out a wildcard domain certificate to some predefined destinations to have it used in anything that wants a certificate. Could be beneficial to a (large) infrastructure to have an always-ready certificate to use for free. Dunno if EV validation will uphold though.
- kureikain 9y agoFor provider with DNS support, you can put it in a cron, and then create symlink or some copy step at the end of cron to copy private key and full chain to appropriate location of your web server. I think acme.sh is the easiet to use in all of clients.
- b3lvedere 9y agoThanks again. Everything works. I've put my DNS to Cloudflare and after that the acme.sh was incredibly easy to implement thanks to their API implementations. Also learned a valuble lesson: *.provider.com is not the same as provider.com :)
- kureikain 9y agoacme.sh is great because it support manual DNS mode. It also way easier to use compare with other similar client. This is all it takes for me. ./acme.sh --issue -d noty.im -d '.noty.im' --dns It then told me to add TXT record, which I just manually do because I used RackSpace cloudns which has no built-in support. I manually verify DNS with dig, when it's ready I just do: ./acme.sh --renew -d noty.im -d '.noty.im' then the cert(private key and full chain) are stored in ~/.acme/noty.im/ These privateky and fullchain can be used directly with nginx without any modification.
- yani 9y agoExcellent! Wildcard certificates are getting deployed tomorrow.
- hardwaresofton 9y agoDon't forget to Donate: https://letsencrypt.org/donate https://letsencrypt.org/donate Also the EFF: https://supporters.eff.org/donate https://supporters.eff.org/donate
- diafygi 9y agoMy suggested amount: recurring donation of $19.84 per month.
- gator-io 9y agoHTTPS vs HTTP usage: https://netmarketshare.com/report.aspx?options=%7B%22filter%22%3A%7B%22%24and%22%3A%5B%7B%22deviceType%22%3A%7B%22%24in%22%3A%5B%22Desktop%2Flaptop%22%5D%7D%7D%5D%7D%2C%22dateLabel%22%3A%22Trend%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22secure%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22https%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222017-03%22%2C%22dateEnd%22%3A%222018-02%22%2C%22segments%22%3A%22-1000%22%7D https://netmarketshare.com/report.aspx?options=%7B%22filter%...
- kirankn 9y agoWonderful news ! Looking forward to using the Wildcard SSLs.
- mbonzo 9y agoHi, I made a video on how to implement Wildcard Certificate for your subdomains. I hope someone finds it useful :) https://www.youtube.com/watch?v=zvg8IXAcUwo&feature=youtu.be https://www.youtube.com/watch?v=zvg8IXAcUwo&feature=youtu.be