Early Impacts of Let's Encrypt

Re:Early Impacts of Let's Encrypt by duaneb on Saturday February 20, 2016 @06:30PM (#11142482)

If you can restrict the service to a subdomain, there are alternatives like the SAN extension that allow those third parties to avoid handling your private key at a small extra cost.

[ Parent | on HN ]

Re:Early Impacts of Let's Encrypt by nailer on Sunday February 21, 2016 @07:04AM (#11144188)

I'm having trouble understanding your comment. SANs are mandatory (current browsers don't even use CNs), how would SANs specifically prevent this? The endpoint where your terminating your traffic obviously must have the private key to decrypt it.

[ Parent | on HN ]

Re:Early Impacts of Let's Encrypt by duaneb on Monday February 22, 2016 @03:58PM (#11154233)

You need one cert (or at least only a handful of certs)—SAN entries do not need to be subdomains of the CN. Greatly reduces headache of ssl-terminating for e.g. client domains.

[ Parent | on HN ]