News for hackers. Stuff that matters.

A comment on Should you use www or not in your domain? (2017).

Re:Should you use www or not in your domain? (2017) by marcus_holmes on Sunday November 11, 2018 @09:43AM (#18426570)
I'm grappling with this question at the moment.

The problem is that Let's Encrypt doesn't support wildcard certs, so having a single cert for the origin and allowing connections on "www." is not possible. This is a problem because a request on "https://www." will be rejected completely rather than redirected to the origin (or vice versa). In other words, I have to choose one, and the other one won't work at all and can't be redirected (for https, but I'm auto-redirecting from http to https as well, so for everything). Obviously, the marketing gains from not having a "www" outweigh any other considerations at this point, so no "www".

As I understand it, anyway. I could be wrong. I hope I'm wrong, and have just misunderstood how this all hangs together.

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by susam on Sunday November 11, 2018 @09:48AM (#18426594)
You can create a certificate with "example.com" as the subject and "www.example.com" as subject alternative name (SAN).

Here is an example certbot command:

  certbot certonly -n --agree-tos -m [email protected] --webroot -w /var/www/example.com -d 'example.com,www.example.com'
The argument to the `-d` option defines all the subject alternative names.
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by djsumdog on Sunday November 11, 2018 @02:10PM (#18427949)
Yea, this is what I do. I wrote a script to automate the process too:

https://github.com/sumdog/bee2/blob/master/dockerfiles/CertB...

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by jasonjayr on Sunday November 11, 2018 @09:45AM (#18426576)
https://community.letsencrypt.org/t/acme-v2-production-envir...

They do support wildcard certs now.

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by zie on Sunday November 11, 2018 @10:18AM (#18426730)
They do, and it's fabulous, but *.example.com certs from LE do not cover the root domain (example.com) so if you do a wildcard cert, you then must also do www.example.com.

unless I'm missing something :)

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by LinuxBender on Monday November 12, 2018 @03:21PM (#18435373)
You can have multiple names in the cert, including the apex.

Here is how I do it using acme.sh:

    acme.sh --issue --dns --force --yes-I-know-dns-manual-mode-enough-go-ahead-please -d "${domain}" -d "*.${domain}" > /dev/shm/.le."${domain}".txt
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by jasonjayr on Sunday November 11, 2018 @01:59PM (#18427900)
I didn't find docs specific to wildcard + non-wildcard, but LE certs can use multiple subject alternate names. So whatever tool you use, use SAN to request both *.example.com and example.com into one cert.

I imagine you have to setup your stuff to respond to the DNS + web based challenge/response.

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by pseudalopex on Sunday November 11, 2018 @01:52PM (#18427862)
You can have example.com and *.example.com on the same certificate.
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by NotANaN on Sunday November 11, 2018 @06:53PM (#18429520)
.
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by ancarda on Sunday November 11, 2018 @09:48AM (#18426593)
You can have multiple domains for a certificate. I usually do something like:

    certbot -d example.com www.example.com [other flags here]
That’s from memory, it might be another -d per domain.
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by kalleboo on Sunday November 11, 2018 @09:47AM (#18426587)
You can have certs with Subject Alternative Name (SAN). So one single cert covers "example.com" and "www.example.com"
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by LinuxBender on Monday November 12, 2018 @03:19PM (#18435356)
I've been using wildcards for all my domains on Lets Encrypt for some time now.
[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by gsich on Sunday November 11, 2018 @09:52AM (#18426621)
>The problem is that Let's Encrypt doesn't support wildcard certs.

They do. Since March 2018.

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by marcus_holmes on Sunday November 11, 2018 @09:34PM (#18430202)
thanks folks :) I had misunderstood, and am rewriting chunks of server code today :)
[ Parent | on HN ]