Hacker News Reader

Dynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK

[1] https://www.dtdns.com/dtsite/faq#hostdomains

View on HN

Let's Encrypt uses the Public Suffix List (https://publicsuffix.org/) in their issuance process to handle those sorts of cases.

LE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.

Yeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.

Also a large majority of them will be on the public suffix list, which LE uses in their rate limiting checks.

https://en.m.wikipedia.org/wiki/Public_Suffix_List

Reply on news.ycombinator.com