4

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI.

What I mean is, with the proliferation of the cloud, almost every web-site owner, even with the smallest possible web-site, has their own IPv4-address. However, every such owner may have several unrelated web-sites on a given IPv4 address as above.

Currently, it would appear that the CA cartels make it cost prohibitive to obtain a single certificate with several distinct CNs specified, making it cheaper to rent extra IPv4 addresses if non-SNI clients must be supported. Will Let's Encrypt be the same, or do they plan to support multiple unrelated CNs per certificate, avoiding the need for a choice between SNI and IPv4-address waste?

Improve this question

2 Answers 2

Reset to default
1

Currently, it would appear that the CA cartels make it cost prohibitive to obtain a single certificate with several distinct CNs specified, making it cheaper to rent extra IPv4 addresses if non-SNI clients must be supported. Will Let's Encrypt be the same, or do they plan to support multiple unrelated CNs per certificate, avoiding the need for a choice between SNI and IPv4-address waste?

From the discussion at https://groups.google.com/a/letsencrypt.org/forum/#!topic/client-dev/2L_7-QN8cGE it seems that they are aware of this issue and that at least the protocol itself supports generation of certificates for multiple domains. If it will be supported in the initial release we will see.

Improve this answer
5
  • 2
    groups.google.com is so horribly slow. :-(
    – cnst
    Jan 10, 2015 at 8:20
  • 1
    @cnst Javascript overdose, because apparently serving plain HTML isn't "hype" enough for them.
    – user42178
    Jan 10, 2015 at 18:45
  • Thanks for posting this link - I'd been looking everywhere for something like this. From my understanding, this suggests that a single certificate could be issued for a collection domains to share; e.g. letsencrypt firstdomain.tld secondone.tld tertiary.tld - is that how you read it?
    – indextwo
    Mar 12, 2015 at 19:10
  • "could" yes, but "will" - I don't know.
    – Steffen Ullrich
    Mar 12, 2015 at 19:16
  • @SteffenUllrich: now that the initial release was made, could you update the answer?
    – d33tah
    Dec 9, 2015 at 10:44
3

According to the post (dated 2015-09-09) in the subjectAltNames certificates thread: yes, subjectAltNames for unrelated domains will be allowed.

Update (from more recent posts in the thread links above):

Users report practical success in generating certificates with multiple domains. There is apparently a limit of 100 names per certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .