5

We have given customers the option to allow custom domains which ultimately point to our server by changing the CNAME.

Some of our customers would like to have SSL enabled to their domain but I am wondering how to manage certificates for them. I am aware about SNI which helps to have multiple certificates for the same IP-address but I still need to buy a certificate for every custom domain and upload it manually.

Is there a way we can automate the process/manage the certificates in better way?

  • Have a look at Let's Encrypt: free certificates (free as in "no money involved") plus automatization for major web servers. – Steffen Ullrich Nov 16 '17 at 6:15
1

You have the options of using let’s encrypt and certbot which automates this process somewhat, as Steffen pointed out in the comments.

Keep in mind that both let’s encrypt and SNI may result in problems with older browsers and operating systems, because some do not support SNI and some do not trust let’s encrypt.

Another (for this Szenario not appropriate) way is to get one certificate for all subdomains, but that’s not meant for this case and will lead to many more problems.

  • At this point in time I'm comfortable saying that anyone whose browser has trouble with SNI websites needs to update their goddamn browser already. – Shadur Jun 13 '18 at 7:03
  • If not even server administrators apply patches regularly and timely (check for heart bleed, for example), you shouldn’t assume the users do. – Tobi Nary Jun 13 '18 at 7:49
1

We ran into the same problem with a SAAS we were building for a client. We ended up using a reverse proxy over Nginx to handle this along with Let’s Encrypt. We ran a script that basically added the domains. A bit tedious but gets the job done.

Addendum: Here’s a service that actually does this for you: https://tenantssl.com

  • 1
    There is a lot of software doing this, e.g. lua-resty-auto-ssl will generate a certificate for all domains you point to the server automatically. – Josef Jun 11 '18 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.