Hacker News Reader

Comment by 0x0 | Hacker News Reader

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.

View on HN

Windows XP & older Android releases are the two most common reasons to care about SNI.

Let's Encrypt actually has compatibility issues with Windows XP, so wildcard certificates wouldn't help.

https://community.letsencrypt.org/t/which-browsers-and-opera...

I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?

Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI.

But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.

That's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.

Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade.

Also I think with Firefox on Windows XP it should work.

That doesn't help when you are targeting a market where Android 2.x is prevalent.

True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?

You'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).

Reply on news.ycombinator.com