Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better support for wildcard domains #92

Closed
JonasAlfredsson opened this issue Nov 19, 2021 · 3 comments
Closed

Better support for wildcard domains #92

JonasAlfredsson opened this issue Nov 19, 2021 · 3 comments

Comments

@JonasAlfredsson
Copy link
Owner

With the latest pull request we added support for DNS challenges, which means that we could now support wildcard domains. Creating a server config which looks like this:

server {
    listen              443 ssl;
    server_name         yourdomain.org *.yourdomain.org;
    ssl_certificate_key /etc/letsencrypt/live/test-name/privkey.pem;
    ...
}

actually produces a functioning wildcard certificate, but this is not really versatile. A possible solution to this is to make something like this possible:

server {
    listen              443 ssl;
    server_name         sub-1.yourdomain.org;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.org/privkey.pem; #wildcard
    ...
}

server {
    listen              443 ssl;
    server_name         sub-2.yourdomain.org;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.org/privkey.pem; #wildcard
    ...
}

where we pick up the trailing comment and make the certificate request for this certificate only be -d yourdomain.org -d *.yourdomain.org.

We probably need some more logic here to identify and extract when this should happen, and we most likely must demand that the cert_name = yourdomain.org, so we can skip the tedious thing of trying to guess the "base" domain from the server_name.

@XaF
Copy link
Contributor

XaF commented Nov 19, 2021

I'd recommend using the same approach we do for other matches at the moment, with a .wildcard or -wildcard somewhere in the cert name. As well as a env variable.
The only part where this gets slightly more involved is the "reduction", but that's actually not that complicated to do to handle.

@XaF
Copy link
Contributor

XaF commented Nov 20, 2021

Just created #94 that should solve this :)

@JonasAlfredsson
Copy link
Owner Author

This should now be included in the v3.0.0 release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants