5 ms·

Letsencrypt Supports Wildcard Certificates

52 points by metadat 2y ago

metadat 2y ago
One great aspect of this is getting HTTPS for free, without your specific subdomain being leaked to the world through the Certificate Transparency (CT) Log. https://letsencrypt.org/docs/ct-logs/ https://letsencrypt.org/docs/ct-logs/ Apparently wildcards have been supported since 2018, but I only discovered this last weekend. Cheers.
- nullindividual 2y ago
  Wildcard certs are generally discouraged in secure environments due to a single cert being compromised can lead to a variety of compromised services -- or an attacker adding their own subdomain and 'valid' service.
  - metadat 2y ago
    Agreed, as a rule of thumb. Yet when it's, say, a certificate for the HomeAssistant service at my personal residence, avoiding the subdomain being published to the transparency log is advantageous from a both a privacy and security perspective. Naturally, best practices depend on the use-case and context.
    - jsheard 2y ago
      If you're relying entirely on LetsEncrypt for a service which uses hundreds or thousands of subdomains (e.g. one per user) then you practically have to use a wildcard too, because generating tons of individual certs for the same top level domain will very quickly run into LEs rate limits.
      - BadBadJellyBean 2y ago
        You can request a higher rate limit: https://isrg.formstack.com/forms/rate_limit_adjustment_request https://isrg.formstack.com/forms/rate_limit_adjustment_reque...
  - stop50 2y ago
    For really secure environments you use your own hardware backed ca.
    - 8372049 2y ago
      On an airgapped network (if possible)
    - dddw 2y ago
      Don't forget to update that hardware then. And to inform whoever inherits the infra to update te ca after 10 years.
    - nullindividual 2y ago
      There are levels of security, or more like levels of risk one can take on. For the home environment, I'd agree that for most wildcards aren't much of a risk. For an SMB, LE with individual certs may be ok. For a multinational bank or similar, yes absolutely HSM on an airgapped CA seems like a better approach.
- iggldiggl 2y ago
  Unfortunately it means you're off the happy path in terms of certificate renewals. Most (?) hosting providers these days probably provide for automated renewal of individual domains, but wildcard certificates are a different matter, especially if your domains are hosted/registered externally and you're not using your hosting providers DNS servers. If you're lucky and your hosting provider is using e.g. Plesk as a hosting panel and has enabled its built-in DNS server, you might be able to use that as a (hidden) primary server and your registrar's DNS as secondaries and let Plesk update the DNS records as required. Otherwise you're left with the problem on how to interface between your hosting providers renewal mechanism and your DNS provider's API (hopefully your DNS provider does have an API?), which means you either need to manually update your certificates after all, or else run your own webserver so you can custom-wire the required DNS updates (and running my own webserver isn't a hobby I currently wish to take up).
theandrewbailey 2y ago
Let's Encrypt has supported wildcard certificates for over 6 years. They're awesome! I've been using them ever since. https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579 https://community.letsencrypt.org/t/acme-v2-and-wildcard-cer...
jsheard 2y ago
I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure.
- diarrhea 2y ago
  Yeah, the landscape is horrible. I created NS records on example.com to delegate all of home.example.com to a wholly different DNS provider. That provider then manages (all of) that zone, but nothing more (important records such as MX remain on example.com).
- yjftsjthsd-h 2y ago
  > so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure. I thought you just created the TXT record once (manually if need be) and it didn't change when the cert is renewed?
  - jsheard 2y ago
    Nah, the value of the TXT record has to be changed every time you pull a new certificate. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ > it only makes sense to use DNS-01 challenges if your DNS provider has an API you can use to automate updates.
- synchrone 2y ago
  > Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server. https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
deleted 2y ago
[deleted]
p-o 2y ago
That's great to see this show up today, I'm actually their wildcard certificate to build a DNS01 Challenge that connects cert-manager(ACME) and external-dns to create a fully open source "ephemeral environments" infrastructure on top of Kubernetes (https://github.com/pier-oliviert/sequencer https://github.com/pier-oliviert/sequencer). It's crazy to think that not too long ago, these certificates would cost a small fortune. I'm really grateful to anyone working on making this available for the world to use.
apple4ever 2y ago
Been using this for years, its awesome!

52 points by metadat 2y ago

One great aspect of this is getting HTTPS for free, without your specific subdomain being leaked to the world through the Certificate Transparency (CT) Log. https://letsencrypt.org/docs/ct-logs/ https://letsencrypt.org/docs/ct-logs/ Apparently wildcards have been supported since 2018, but I only discovered this last weekend. Cheers.

nullindividual 2y ago
Wildcard certs are generally discouraged in secure environments due to a single cert being compromised can lead to a variety of compromised services -- or an attacker adding their own subdomain and 'valid' service.
- metadat 2y ago
  Agreed, as a rule of thumb. Yet when it's, say, a certificate for the HomeAssistant service at my personal residence, avoiding the subdomain being published to the transparency log is advantageous from a both a privacy and security perspective. Naturally, best practices depend on the use-case and context.
  - jsheard 2y ago
    If you're relying entirely on LetsEncrypt for a service which uses hundreds or thousands of subdomains (e.g. one per user) then you practically have to use a wildcard too, because generating tons of individual certs for the same top level domain will very quickly run into LEs rate limits.
    - BadBadJellyBean 2y ago
      You can request a higher rate limit: https://isrg.formstack.com/forms/rate_limit_adjustment_request https://isrg.formstack.com/forms/rate_limit_adjustment_reque...
- stop50 2y ago
  For really secure environments you use your own hardware backed ca.
  - 8372049 2y ago
    On an airgapped network (if possible)
  - dddw 2y ago
    Don't forget to update that hardware then. And to inform whoever inherits the infra to update te ca after 10 years.
  - nullindividual 2y ago
    There are levels of security, or more like levels of risk one can take on. For the home environment, I'd agree that for most wildcards aren't much of a risk. For an SMB, LE with individual certs may be ok. For a multinational bank or similar, yes absolutely HSM on an airgapped CA seems like a better approach.
iggldiggl 2y ago
Unfortunately it means you're off the happy path in terms of certificate renewals. Most (?) hosting providers these days probably provide for automated renewal of individual domains, but wildcard certificates are a different matter, especially if your domains are hosted/registered externally and you're not using your hosting providers DNS servers. If you're lucky and your hosting provider is using e.g. Plesk as a hosting panel and has enabled its built-in DNS server, you might be able to use that as a (hidden) primary server and your registrar's DNS as secondaries and let Plesk update the DNS records as required. Otherwise you're left with the problem on how to interface between your hosting providers renewal mechanism and your DNS provider's API (hopefully your DNS provider does have an API?), which means you either need to manually update your certificates after all, or else run your own webserver so you can custom-wire the required DNS updates (and running my own webserver isn't a hobby I currently wish to take up).

theandrewbailey 2y ago

Let's Encrypt has supported wildcard certificates for over 6 years. They're awesome! I've been using them ever since. https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579 https://community.letsencrypt.org/t/acme-v2-and-wildcard-cer...

jsheard 2y ago

I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure.

diarrhea 2y ago
Yeah, the landscape is horrible. I created NS records on example.com to delegate all of home.example.com to a wholly different DNS provider. That provider then manages (all of) that zone, but nothing more (important records such as MX remain on example.com).
yjftsjthsd-h 2y ago
> so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure. I thought you just created the TXT record once (manually if need be) and it didn't change when the cert is renewed?
- jsheard 2y ago
  Nah, the value of the TXT record has to be changed every time you pull a new certificate. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ > it only makes sense to use DNS-01 challenges if your DNS provider has an API you can use to automate updates.
synchrone 2y ago
> Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server. https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

deleted 2y ago

[deleted]

p-o 2y ago

That's great to see this show up today, I'm actually their wildcard certificate to build a DNS01 Challenge that connects cert-manager(ACME) and external-dns to create a fully open source "ephemeral environments" infrastructure on top of Kubernetes (https://github.com/pier-oliviert/sequencer https://github.com/pier-oliviert/sequencer). It's crazy to think that not too long ago, these certificates would cost a small fortune. I'm really grateful to anyone working on making this available for the world to use.

apple4ever 2y ago

Been using this for years, its awesome!