Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

Re:Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate by Johnny555 on Monday November 14, 2016 @07:06PM (#12954516)

There's a limit to how many SAN's you can fit in one cert. There is apparently no defined upper bound, but dependent on the client's implementation. 25 - 100 names seems to be the common limit supported by most registrars.

In the parent poster's case, it sounds like a good use case for a wildcard cert. They may have thousands of affiliates, and may not know all of the affiliates ahead of time, so with a SAN cert, would need to reissue the certificate each time a new affiliate signs up.

https://community.letsencrypt.org/t/subjectaltname-certifica...

[ Parent | on HN ]

Re:Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate by duaneb on Monday November 14, 2016 @08:37PM (#12954925)

Oh, I completely agree—I maintain a SAN and it's a royal pain in the ass.

But there are options, and a SAN has lower risk if your key is leaked (only the enumerated domains will validate).

[ Parent | on HN ]