July 17th, 2024

Letsencrypt Supports Wildcard Certificates

Let's Encrypt offers free SSL/TLS certificates for secure HTTPS connections, relying on donations. They issue Domain Validation and SAN certificates, recommend reporting malicious activities, and emphasize TLS/SSL security.

Read original articleLink Icon
Letsencrypt Supports Wildcard Certificates

Let's Encrypt is a global Certificate Authority offering free SSL/TLS certificates to enable secure HTTPS connections for websites. They do not charge for their services and rely on donations and sponsorships to operate. Let's Encrypt does not provide direct support but offers documentation and community forums for assistance. In case of malicious activities on a website using their certificates, users are advised to report to Google Safe Browsing and Microsoft Smart Screen. The certificates are valid for 90 days and can be renewed automatically every 60 days. Let's Encrypt issues Domain Validation certificates and supports Subject Alternative Name (SAN) certificates but does not provide Organization Validation (OV) or Extended Validation (EV) certificates. Private keys are not stored on Let's Encrypt servers, and users can use various ACME clients like Certbot for certificate management. The organization emphasizes the importance of TLS/SSL and PKI security, providing resources for further learning.

Link Icon 6 comments
By @theandrewbailey - 6 months
Let's Encrypt has supported wildcard certificates for over 6 years. They're awesome! I've been using them ever since.

https://community.letsencrypt.org/t/acme-v2-and-wildcard-cer...

By @metadat - 6 months
One great aspect of this is getting HTTPS for free, without your specific subdomain being leaked to the world through the Certificate Transparency (CT) Log.

https://letsencrypt.org/docs/ct-logs/

Apparently wildcards have been supported since 2018, but I only discovered this last weekend.

Cheers.

By @jsheard - 6 months
I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure.
By @p-o - 6 months
That's great to see this show up today, I'm actually their wildcard certificate to build a DNS01 Challenge that connects cert-manager(ACME) and external-dns to create a fully open source "ephemeral environments" infrastructure on top of Kubernetes (https://github.com/pier-oliviert/sequencer).

It's crazy to think that not too long ago, these certificates would cost a small fortune. I'm really grateful to anyone working on making this available for the world to use.

By @apple4ever - 6 months
Been using this for years, its awesome!