> with a de facto maximum of about a 100 100 is the exact maximum by policy from Let's Encrypt, but if you're interested in more details about what CAs can do,

> with a de facto maximum of about a 100 100 is the exact maximum by policy from Let's Encrypt, but if you're interested in more details about what CAs can do, there is a great thread on the Let's Encrypt Community Forum about the nature of the limitations: https://community.letsencrypt.org/t/is-there-an-rfc-that-covers-cert-size-limits/63122 https://community.letsencrypt.org/t/is-there-an-rfc-that-cov... Two resources mentioned there are https://1000-sans.badssl.com/ https://1000-sans.badssl.com/ https://10000-sans.badssl.com/ https://10000-sans.badssl.com/ which you can use to experiment with TLS client behavior in the presence of unusually large numbers of SANs.