Hacker News Reader

Comment by metadat | Hacker News Reader

One great aspect of this is getting HTTPS for free, without your specific subdomain being leaked to the world through the Certificate Transparency (CT) Log.

https://letsencrypt.org/docs/ct-logs/

Apparently wildcards have been supported since 2018, but I only discovered this last weekend.

Cheers.

View on HN

Unfortunately it means you're off the happy path in terms of certificate renewals.

Most (?) hosting providers these days probably provide for automated renewal of individual domains, but wildcard certificates are a different matter, especially if your domains are hosted/registered externally and you're not using your hosting providers DNS servers.

If you're lucky and your hosting provider is using e.g. Plesk as a hosting panel and has enabled its built-in DNS server, you might be able to use that as a (hidden) primary server and your registrar's DNS as secondaries and let Plesk update the DNS records as required.

Otherwise you're left with the problem on how to interface between your hosting providers renewal mechanism and your DNS provider's API (hopefully your DNS provider does have an API?), which means you either need to manually update your certificates after all, or else run your own webserver so you can custom-wire the required DNS updates (and running my own webserver isn't a hobby I currently wish to take up).

Wildcard certs are generally discouraged in secure environments due to a single cert being compromised can lead to a variety of compromised services -- or an attacker adding their own subdomain and 'valid' service.

Agreed, as a rule of thumb.

Yet when it's, say, a certificate for the HomeAssistant service at my personal residence, avoiding the subdomain being published to the transparency log is advantageous from a both a privacy and security perspective.

Naturally, best practices depend on the use-case and context.

If you're relying entirely on LetsEncrypt for a service which uses hundreds or thousands of subdomains (e.g. one per user) then you practically have to use a wildcard too, because generating tons of individual certs for the same top level domain will very quickly run into LEs rate limits.

You can request a higher rate limit: https://isrg.formstack.com/forms/rate_limit_adjustment_reque...

For really secure environments you use your own hardware backed ca.

There are levels of security, or more like levels of risk one can take on. For the home environment, I'd agree that for most wildcards aren't much of a risk. For an SMB, LE with individual certs may be ok. For a multinational bank or similar, yes absolutely HSM on an airgapped CA seems like a better approach.

Don't forget to update that hardware then. And to inform whoever inherits the infra to update te ca after 10 years.

On an airgapped network (if possible)

Reply on news.ycombinator.com