4 ms·
I saw in an earlier thread that wildcard certs won't be supported at first, but possibly in the future. An additional comment was made that wildcard certs would
by ohitsdom 11y ago
I saw in an earlier thread that wildcard certs won't be supported at first, but possibly in the future. An additional comment was made that wildcard certs wouldn't be necessary once the cert issuing/renewal process is automated.
My question is: wouldn't wildcard certs be faster if the behavior on your site skipped around different subdomains? One certificate for all vs individual certs for each subdomain. I may be way off, I'm a novice when it comes to SSL/TLS handshake so please correct my ignorance.
- derefr 11y agoMaybe the question is wildcard vs SAN certs. With automated cert issuing/renewal, they could theoretically talk to e.g. Cloudflare's API to get your DNS records, if you're with them, and then regenerate a new SAN cert containing exactly the subdomains you really have whenever that list of subdomains changes. Which is probably more secure in some way I don't understand. You're right about the "just using a bunch of separate certs" solution being slower, though, especially with HTTP/2 (which, because of origin combining, uses exactly one real socket per TLS cert.)
- tombrossman 11y agoLet's say you host your site on your own server at www.example.com. You want that to be served by HTTPS. You also have a subdomain cdn.example.com for static assets which is CNAME'd to a proper CDN that you want to use HTTPS with also. With a wildcard cert, the third-party CDN would need your private key for your self-hosted www.example.com site. With different keys & certs per-site, the process is more modular. I agree that wildcard certs would be great and I'll default to using them for the simplicity (e.g. temporarily activate a quick test.example.com site to check something works) but the ability to keep things modular is also great.