9

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? If not does that mean an expensive wildcard SSL certificate will need to be used with these domains?

So if I have a service running at sub.domain.com that has a web GUI to control it, will I not be able to reach that without a wildcard cert (or separate cert for that sub)?

Improve this question
1
  • 4
    Wildcard certs are not expensive. You can get them for free, just like any certificate, from Lets Encrypt. You just have to use DNS-01 rather than HTTP-01 because the latter inherently cannot prove authority for the wildcard.
    – R.. GitHub STOP HELPING ICE
    May 18 at 14:04

2 Answers 2

Reset to default
27

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains?

No. Mandatory means that TLS is not only required for the "bare" domain but also for the subdomains.

If not does that mean an expensive wildcard SSL certificate will need to be used with these domains?

No. First, you don't need a wildcard to serve subdomains but you can use subdomain specific certificates. Also, you can get wildcard certificates for free from publicly trusted CA like Let's Encrypt.

Improve this answer
5
  • Wait, what? DNS has nothing to do with TLS. How can a registrar require that a TLS certificate be used? Not to mention the fact that not all protocols are capable of using TLS. Is this really a thing today and how is it enforced?
    – Vilx-
    May 17 at 21:39
  • 10
    @Vilx-: DNS has nothing to do with this. The enforcement is done in the browsers. You are free to write a client that does not enforce this the same as you are free to write a client which ignores the HSTS HTTP header. But the major browsers enforce it, which makes it de facto mandatory. See also blog.nameshield.com/blog/2018/04/19/… "not all protocols are capable of using TLS" - this is about HTTPS, i.e. HTTP over TLS. It is not about other protocols.
    – Steffen Ullrich
    May 17 at 22:03
  • Ahh! Now that makes more sense! Thanks!
    – Vilx-
    May 17 at 22:34
  • @SteffenUllrich Is an HTTP header even involved for the TLD-level requirement? I assumed the browsers just had lists of TLDs for which HTTPS was mandatory.
    – muru
    May 18 at 5:13
  • 2
    @muru: HSTS comes in two flavors: set by the domain itself using a header or preloaded in the browser. TLD are handled by the latter mechanism. See also curl 'https://chromium.googlesource.com/chromium/src/+/main/net/http/transport_security_state_static.json?format=TEXT' | base64 -d
    – Steffen Ullrich
    May 18 at 5:20
15

A single certificate can cover a large number of domains through the Subject Alternative Name (SAN) extension. The maximum number may vary between different CAs, but Let's Encrypt supports up to 100 SANs. Wildcard certificates are only needed if you have a vast number of subdomains that cannot be realistically covered with SANs, or if the subdomains are highly dynamic. And as Steffen Ullrich already pointed out, you can get wildcard certificates for free now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .