3 ms·

For anyone wondering how to actually obtain a wildcard cert this way, here's the quick version: 1. Use acme.sh: https://github.com/Neilpang/acme.sh https://git

For anyone wondering how to actually obtain a wildcard cert this way, here's the quick version: 1. Use acme.sh: https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh acme.sh --issue -d *.example.com --dns If your DNS provider has a supported api, you may be able to automatically publish the DNS records required using a slightly different command - see here: https://github.com/Neilpang/acme.sh/tree/master/dnsapi https://github.com/Neilpang/acme.sh/tree/master/dnsapi

b3lvedere 9y ago
Thanks! This looks awesome. Can i automate it as well? I have been toying a little with wildcard using certbot on my Ubuntu OpenVPN appliance, but was a bit unsuccessful at the moment. Maybe i should just try and build a very tiny virtual sever that does nothing but spit out a wildcard domain certificate to some predefined destinations to have it used in anything that wants a certificate. Could be beneficial to a (large) infrastructure to have an always-ready certificate to use for free. Dunno if EV validation will uphold though.
- kureikain 9y ago
  For provider with DNS support, you can put it in a cron, and then create symlink or some copy step at the end of cron to copy private key and full chain to appropriate location of your web server. I think acme.sh is the easiet to use in all of clients.
  - b3lvedere 9y ago
    Thanks again. Everything works. I've put my DNS to Cloudflare and after that the acme.sh was incredibly easy to implement thanks to their API implementations. Also learned a valuble lesson: *.provider.com is not the same as provider.com :)
kureikain 9y ago
acme.sh is great because it support manual DNS mode. It also way easier to use compare with other similar client. This is all it takes for me. ./acme.sh --issue -d noty.im -d '.noty.im' --dns It then told me to add TXT record, which I just manually do because I used RackSpace cloudns which has no built-in support. I manually verify DNS with dig, when it's ready I just do: ./acme.sh --renew -d noty.im -d '.noty.im' then the cert(private key and full chain) are stored in ~/.acme/noty.im/ These privateky and fullchain can be used directly with nginx without any modification.

b3lvedere 9y ago

Thanks! This looks awesome. Can i automate it as well? I have been toying a little with wildcard using certbot on my Ubuntu OpenVPN appliance, but was a bit unsuccessful at the moment. Maybe i should just try and build a very tiny virtual sever that does nothing but spit out a wildcard domain certificate to some predefined destinations to have it used in anything that wants a certificate. Could be beneficial to a (large) infrastructure to have an always-ready certificate to use for free. Dunno if EV validation will uphold though.

kureikain 9y ago
For provider with DNS support, you can put it in a cron, and then create symlink or some copy step at the end of cron to copy private key and full chain to appropriate location of your web server. I think acme.sh is the easiet to use in all of clients.
- b3lvedere 9y ago
  Thanks again. Everything works. I've put my DNS to Cloudflare and after that the acme.sh was incredibly easy to implement thanks to their API implementations. Also learned a valuble lesson: *.provider.com is not the same as provider.com :)

kureikain 9y ago

acme.sh is great because it support manual DNS mode. It also way easier to use compare with other similar client. This is all it takes for me. ./acme.sh --issue -d noty.im -d '.noty.im' --dns It then told me to add TXT record, which I just manually do because I used RackSpace cloudns which has no built-in support. I manually verify DNS with dig, when it's ready I just do: ./acme.sh --renew -d noty.im -d '.noty.im' then the cert(private key and full chain) are stored in ~/.acme/noty.im/ These privateky and fullchain can be used directly with nginx without any modification.