4 ms·

Both, technically. CommonName has been deprecated for years, so all of Caddy's certificates (and all of Let's Encrypt's) are SAN certificates. Caddy manages si

by mholt 7y ago

Both, technically. CommonName has been deprecated for years, so all of Caddy's certificates (and all of Let's Encrypt's) are SAN certificates. Caddy manages single-SAN certs, in accordance with recommended best practices: https://docs.https.dev/acme-ops#use-one-name-per-certificate https://docs.https.dev/acme-ops#use-one-name-per-certificate (We learned from experience that single SAN scales better and is less prone to troubles. For example, Caddy sites were not affected by the recent Let's Encrypt revocation incident because it manages only single-SAN certificates. And frankly, that shouldn't matter since you don't have to manage them.)

Tomte 7y ago
Ah, TIL. I was asking because right now my nginx/certbot setup requests a single certificate for all my domains, and I would like to have them separate. (I'm sure you can do that with certbot, I just haven't tweaked my setup, yet)
- mholt 7y ago
  I see. Yeah, I think CertBot does that because of limitations in Apache (and possibly nginx as well) with "virtual hosting". So yeah, Caddy uses one name per certificate by default, and there's no way to change that.
- purerandomness 7y ago
  A certificate can be issued for as many, or as few domains as you'd like. Look at certbot's -d parameter, this does not have anything to do with nginx, apache, caddy or any other web server.
  - Tomte 7y ago
    Is that also possible when using --nginx? Or only in "vanilla" mode?
    - purerandomness 7y ago
      The nginx autoconfiguration plugin has no influence on how many domains the certificate you're requesting will be valid for. Example: We run a SaaS on our client's domains, so for every client, we have to run `certbot -d subdomain.client1.com,client1.ourdomain.com,staging.client1.ourdomain.com,...` That means we run certbot with ~4 domains (we include staging and other subdomains) for each client we have. This is highly automatable. Whether you use nginx autoconfiguration or not is up to you.
      - Tomte 7y ago
        I don't understand you. Does the nginx autoconfiguration allow separate certificates, or do you simply say "don't use that"?
        purerandomness 7y ago
        No no, you should totally use separate certificates (for our SaaS that's crucial, otherwise we would let our competitors know who our entire client base is, if all the domains would be included in one certificate) I don't know too much about certbot's nginx plugin, I don't use it and don't see the benefit to be honest, we ran into problems with it (it didn't work for us because our clients have to set up a CNAME DNS entry, and that domain has to be included in the certificate) We simply run certbot without the nginx plugin, and then have a config template for new virtual servers in nginx, based on a template. Certbot's nginx plugin would mess with our config constantly, changing from version to version, leaving artifacts, and we didn't like that.
        Tomte 7y ago
        Thanks for the advice! I'll look at it all on the weekend.
        purerandomness 6y ago
        Good luck! I'd also recommend splitting the config into multiple files, like it has been best practice for the last decades [1] (link goes to Arch (which I also recommend using) but the advice is not Arch specific) [1] https://wiki.archlinux.org/index.php/Nginx#Managing_server_entries https://wiki.archlinux.org/index.php/Nginx#Managing_server_e...

by mholt 7y ago

Tomte 7y ago

Ah, TIL. I was asking because right now my nginx/certbot setup requests a single certificate for all my domains, and I would like to have them separate. (I'm sure you can do that with certbot, I just haven't tweaked my setup, yet)

mholt 7y ago
I see. Yeah, I think CertBot does that because of limitations in Apache (and possibly nginx as well) with "virtual hosting". So yeah, Caddy uses one name per certificate by default, and there's no way to change that.
purerandomness 7y ago
A certificate can be issued for as many, or as few domains as you'd like. Look at certbot's -d parameter, this does not have anything to do with nginx, apache, caddy or any other web server.
- Tomte 7y ago
  Is that also possible when using --nginx? Or only in "vanilla" mode?
  - purerandomness 7y ago
    The nginx autoconfiguration plugin has no influence on how many domains the certificate you're requesting will be valid for. Example: We run a SaaS on our client's domains, so for every client, we have to run `certbot -d subdomain.client1.com,client1.ourdomain.com,staging.client1.ourdomain.com,...` That means we run certbot with ~4 domains (we include staging and other subdomains) for each client we have. This is highly automatable. Whether you use nginx autoconfiguration or not is up to you.
    - Tomte 7y ago
      I don't understand you. Does the nginx autoconfiguration allow separate certificates, or do you simply say "don't use that"?
      - purerandomness 7y ago
        No no, you should totally use separate certificates (for our SaaS that's crucial, otherwise we would let our competitors know who our entire client base is, if all the domains would be included in one certificate) I don't know too much about certbot's nginx plugin, I don't use it and don't see the benefit to be honest, we ran into problems with it (it didn't work for us because our clients have to set up a CNAME DNS entry, and that domain has to be included in the certificate) We simply run certbot without the nginx plugin, and then have a config template for new virtual servers in nginx, based on a template. Certbot's nginx plugin would mess with our config constantly, changing from version to version, leaving artifacts, and we didn't like that.
        Tomte 7y ago
        Thanks for the advice! I'll look at it all on the weekend.
        purerandomness 6y ago
        Good luck! I'd also recommend splitting the config into multiple files, like it has been best practice for the last decades [1] (link goes to Arch (which I also recommend using) but the advice is not Arch specific) [1] https://wiki.archlinux.org/index.php/Nginx#Managing_server_entries https://wiki.archlinux.org/index.php/Nginx#Managing_server_e...