Can this be used for multi-level subdomains? Like *.subdomain.example.org?
[deleted]
ACME v2 and Wildcard Certificate Support is Live
121–130 of 321 posts
Re: ACME v2 and Wildcard Certificate Support is Live
#122DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
Store your DNS records under revision control, and updating your records can be as simple as a "git commit && git push". https://dns-api.com/
That's pretty expensive, esp for side projects. I'm using a certbot extension for CloudFlare. Completely free.
Re: ACME v2 and Wildcard Certificate Support is Live
#123One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's autom…
Just remember that the cert will be logged (Certificate Transparency) so any names there will be disclosed to the public. Wildcards help a little here though.
Re: ACME v2 and Wildcard Certificate Support is Live
#124DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
is it common for DNS hosts to provide delegated access at the granularity of individual records? I don't want my webserver to have the ability to change my entire zonefile just so it can authorise certificates!
In OVH you can restrict token access to individual resources (in this case one record) at token creation time.
Re: ACME v2 and Wildcard Certificate Support is Live
#125Re: ACME v2 and Wildcard Certificate Support is Live
#126DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
Store your DNS records under revision control, and updating your records can be as simple as a "git commit && git push". https://dns-api.com/
Shameless plug: https://github.com/StackExchange/dnscontrol is a provider independent way to manage your zones with a single dsl style file in source control.
Re: ACME v2 and Wildcard Certificate Support is Live
#127I do hope GitHub employs this for rolling out https for Pages sites using custom domains too.
Not Let's Encrypt, but you can run behind cloudflare's free plan for https.
Re: ACME v2 and Wildcard Certificate Support is Live
#128On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved
It didn't take us years to implement. We didn't internally decide to support wildcards until around May 2017 - it wasn't a foregone conclusion that we would ever support them. We didn't start technical work on wildcards until late 2017.
Specifying and implementing ACMEv2 took a while, that was a lot of work. Adding wildcard support on top of that wasn't trivial but it wasn't nearly as much work.
Re: ACME v2 and Wildcard Certificate Support is Live
#129Earlier quoted context omitted.
> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.
The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…
The nasty language in reply to your comments is righteous anger. You are advocating to hurt people; the proper response by well-adjusted people to such advocacy is anger.
You will see the same sort of anger at e.g. parents who refuse to get their kids vaccinated (they're my kids, they say; Big Pharma can't make decisions for me, if you want to get your kids vaccinated, that's fine but there's a cost-benefit analysis, I just don't want it forced down my throat). It would be incorrect to conclude that the angry people are the wrong people.
Re: ACME v2 and Wildcard Certificate Support is Live
#130Earlier quoted context omitted.
> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.
The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…
You're getting strident comments and downvotes primarily because of the un-necessarily harsh and condescending tone of your post.