Hacker News Reader

Comment by marcus_holmes | Hacker News Reader

I'm grappling with this question at the moment.

The problem is that Let's Encrypt doesn't support wildcard certs, so having a single cert for the origin and allowing connections on "www." is not possible. This is a problem because a request on "https://www." will be rejected completely rather than redirected to the origin (or vice versa). In other words, I have to choose one, and the other one won't work at all and can't be redirected (for https, but I'm auto-redirecting from http to https as well, so for everything). Obviously, the marketing gains from not having a "www" outweigh any other considerations at this point, so no "www".

As I understand it, anyway. I could be wrong. I hope I'm wrong, and have just misunderstood how this all hangs together.

View on HN

You can create a certificate with "example.com" as the subject and "www.example.com" as subject alternative name (SAN).

Here is an example certbot command:

  certbot certonly -n --agree-tos -m example@example.com --webroot -w /var/www/example.com -d 'example.com,www.example.com'

The argument to the `-d` option defines all the subject alternative names.

Yea, this is what I do. I wrote a script to automate the process too:

https://github.com/sumdog/bee2/blob/master/dockerfiles/CertB...

https://community.letsencrypt.org/t/acme-v2-production-envir...

They do support wildcard certs now.

They do, and it's fabulous, but *.example.com certs from LE do not cover the root domain (example.com) so if you do a wildcard cert, you then must also do www.example.com.

unless I'm missing something :)

You can have example.com and *.example.com on the same certificate.

I didn't find docs specific to wildcard + non-wildcard, but LE certs can use multiple subject alternate names. So whatever tool you use, use SAN to request both *.example.com and example.com into one cert.

I imagine you have to setup your stuff to respond to the DNS + web based challenge/response.

You can have multiple names in the cert, including the apex.

Here is how I do it using acme.sh:

    acme.sh --issue --dns --force --yes-I-know-dns-manual-mode-enough-go-ahead-please -d "${domain}" -d "*.${domain}" > /dev/shm/.le."${domain}".txt

You can have multiple domains for a certificate. I usually do something like:

    certbot -d example.com www.example.com [other flags here]

That’s from memory, it might be another -d per domain.

You can have certs with Subject Alternative Name (SAN). So one single cert covers "example.com" and "www.example.com"

I've been using wildcards for all my domains on Lets Encrypt for some time now.

>The problem is that Let's Encrypt doesn't support wildcard certs.

They do. Since March 2018.

thanks folks :) I had misunderstood, and am rewriting chunks of server code today :)

Reply on news.ycombinator.com