Hacker News Reader

I've been using Caddy for personal projects and I don't even think about HTTPS anymore. Except when I have to use another web server at work :-/

View on HN

That is fine for simple projects where all you have to do is automate cert updates for the root domain or a few subdomains. The problem is not to automate this process. It's easy to write a shellscript that regularly updates certs for a root domain or some subdomains.

The problem is that letsencrypt does not offer url based authentification for wildcard certs.

So you have to temper with your DNS infrastructure so that you can automate DNS updates for your domain.

Add to it that wildcard certificates are nice for not showing your sub-domains in certificate transparency logs.

> The problem is that letsencrypt does not offer url based authentification for wildcard certs.

For good reason though. You shouldn't be able to get a cert for a domain you cannot prove you control. Lots of people have webserver access to a specific domain but not all subdomains.

Which users have access to put files into .well-known/ of the root domain?

I am not aware of any service that allows that.

Can you give an example? What do you mean by "lots of people"?

Reply on news.ycombinator.com