11 ms·
That is fine for simple projects where all you have to do is automate cert updates for the root domain or a few subdomains. The problem is not to automate this
by JonathanBeuys 3y ago
That is fine for simple projects where all you have to do is automate cert updates for the root domain or a few subdomains. The problem is not to automate this process. It's easy to write a shellscript that regularly updates certs for a root domain or some subdomains.
The problem is that letsencrypt does not offer url based authentification for wildcard certs.
So you have to temper with your DNS infrastructure so that you can automate DNS updates for your domain.
- bawolff 3y ago> The problem is that letsencrypt does not offer url based authentification for wildcard certs. For good reason though. You shouldn't be able to get a cert for a domain you cannot prove you control. Lots of people have webserver access to a specific domain but not all subdomains.
- JonathanBeuys 3y agoWhich users have access to put files into .well-known/ of the root domain? I am not aware of any service that allows that. Can you give an example? What do you mean by "lots of people"?
- ozim 3y agoAdd to it that wildcard certificates are nice for not showing your sub-domains in certificate transparency logs.