Worked like a champ!
> Will Let’s Encrypt issue wildcard certificates?
> We currently have no plans to do so, but it is a possibility in the future. Hopefully wildcards aren’t necessary for the vast majority of our potential subscribers because it should be easy to get and manage certificates for all subdomains.
From https://community.letsencrypt.org/t/frequently-asked-questio...
[1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
Weird, why allow a generous 500 registrations per 3 hours, while limiting certs per domain like this? Anyone have a link to anywhere that letsencrypt explains what they are trying to do here?
Certificates have to be signed by a Hardware Security Module with limited capacity. OCSP messages have to be signed every couple of days for the lifetime of a cert by the same HSM. This is significantly harder (and more expensive) to scale.
Because if so, that would seem to make the certs-per-domain limits not so much of a problem. If you own example.com, and have customers using sub-domains at a.example.com, b.example.com, etc -- that would seem to make example.com suitable for inclusion on the "PRIVATE" section of the list.
No?
"owners of privately-registered domains who themselves issue subdomains to mutually-untrusting parties may wish to be added to the PRIVATE section of the list... Requests for changes to the PRIVATE section must come from the domain owner."
https://publicsuffix.org/submit/
And indeed there are a few dozen random .com, .net, etc domains in the PRIVATE section. For instance `github.io` is listed there.
If that's the way for SaaS providers to get free certs from letsencrypt for their customers at customername.provider.com, I'd expect to see the listings in the PRIVATE section skyrocket.
You're right about this being rather easy to bypass, but the main goal is probably not to mitigate against abuse but rather prevent buggy automation scripts stuck in some kind of infinite loop from DDoSing them.
[1]: https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns...
Here's where I got mine, works great.
Important though, for compatability with firefox and some other browsers, you'll need to copy the intermediate cert to the end of the cert file. it works fine with 2 certs in the file, just put the intermediate at the end.
I almost pasted the page into something else to make it easier to read - before realising how short it was! It's still a touch off-putting as it is.
Process of getting ssl certs is not very simple and the way you laid it out for us/me really helped.
My small site I used as example zeljko.rocks is now https secured.
Printed the public key and that worked fine. Went to step 2 and pasted in my CSR, and that also worked fine.
Basically Start Keychain -> "Request a Certificate from a Certificate Authority" -> Save to disk.
Though weirdly enough, my public key generated from keygen didn't quite work, I actually had to use
"openssl rsa -in myPrivateKey -pubout" for it to accept it. Why is that?