Hacker News Reader

Comment by zzzcpan | Hacker News Reader

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

View on HN

Yep. You can get 20 different certificates per domain per week, with up to 100 names on each.

https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

Wildcard certs are also a huge need for platforms like Sandstorm.io which opens documents on arbitrary/randomly-generated subdomains. And as someone who hosts a lot of things on various subdomains in general, the idea of having a bunch of different certs is far less appealing than a wildcard cert.

But unfortunately it doesn't seem like Let's Encrypt currently has any plans to add wildcard certs any time soon.

If you're generating that many subdomains (and you control the subdomains), it's probably worth investing in a traditional wildcard cert.

Though, it would be nice if the likes of dyndns names were given exception, since they are effectively second level tld's.

LE uses the Public Suffix List to decide what's a "domain". Their really-low rate limits have caused a flood of applications which are overwhelming the PSL's maintainers.

https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns...

Though if you are a hosting provider for example, I'm sure you could try to negotiate a deal with let's encrypt for more tolerant rate limits for a bit of sponsoring.

We do, in limited cases for large providers (we can only handle so many requests), adjust rate limits. Such adjustments are never dependent on sponsorship, though sponsorship is nice.

It sounds like you are doing something serious enough that Let's Encrypt might not meet your needs in other ways. Pay up for a wildcard cert or refactor subdomains out of your architecture.

Reply on news.ycombinator.com