4 ms·
On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete,
by thinkloop 9y ago
On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved
- mholt 9y agoFrom the CA's perspective or the subscriber's perspective?
- thinkloop 9y agoI was wondering from let's encrypt's perspective, it has taken years to develop, and I know there is good reason for that, I just can't put my finger on what exactly those reasons are.
- kardos 9y agoDynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK [1] https://www.dtdns.com/dtsite/faq#hostdomains https://www.dtdns.com/dtsite/faq#hostdomains
- crtasm 9y agoLE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.
- kardos 9y agoYeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.
- crtasm 9y agoAlso a large majority of them will be on the public suffix list, which LE uses in their rate limiting checks. https://en.m.wikipedia.org/wiki/Public_Suffix_List https://en.m.wikipedia.org/wiki/Public_Suffix_List
- discreditable 9y agoLet's Encrypt uses the Public Suffix List (https://publicsuffix.org/ https://publicsuffix.org/) in their issuance process to handle those sorts of cases.
- jaas 9y agoIt didn't take us years to implement. We didn't internally decide to support wildcards until around May 2017 - it wasn't a foregone conclusion that we would ever support them. We didn't start technical work on wildcards until late 2017. Specifying and implementing ACMEv2 took a while, that was a lot of work. Adding wildcard support on top of that wasn't trivial but it wasn't nearly as much work.