Let's Encrypt Wildcard Certificates

Mike, can you please elaborate on how Let’s Encrypt wildcard certificates would better suit your needs than the current AutoSSL feature?

Wildcard support notwithstanding, the ACME v2 protocol itself appears to offer no benefit to cPanel servers over the draft protocol but requires more HTTP overhead. More problematic is Let’s Encrypt’s rate limit of 300 certificates per hour, which they only apply to their v2 endpoint. A large server that enables Let’s Encrypt via the current v1 AutoSSL provider can reasonably expect optimal coverage from a single AutoSSL run, but using Let’s Encrypt’s ACME v2 endpoint that same server would take many hours—even days—to provision all of those certificates.

Wildcard SSL is required for projects where subdomains need to be created automatically. It could be a WordPress multi site install or any other tool that needs to be able to add new subdomains.

We have a custom built project that needs to be avle to create subdomains automatically, we found that cPanel uapi can’t do this so we will buy a wildcard cert from Comodo to do this.

If let’s Encrypt depreciates acme v1 we would need the v2 as we have customers who have specifically told us they want Let’s Encrypt and not Comodo.

We originally moved from Comodo to Let’s Encrypt because Comodo certs weren’t compatible with alder MacOS mail on Mac OS before El Capitaine.

300 certs per hour would require cpanel’s autossl feature planning for this limit and leaving headroom for new accounts.

On a sever that needs 3000 new certs that could be done in 10 hours if autossl detects the limit and waits for the next hour and not the next day.

The issue here is that let’s Encrypt provides wildcard certs so if we offer let’s encrypt customers expect to have it too and even if cPanel was to provide Comodo wildcard certs customers would still be requesting Let’s Encrypt.

I think the main point here is customers are looking for wildcard support, whether it's AutoSSL or LE. We have customers contacting us asking for it and we can't say yes to it.

I think as you can imagine, if you decide to support AutoSSL & LE (which it seems you have already committed to), when they release new features, your customers will likely want them.

Here is how your competitor is handling it. Disabled by default. Given your argument above, I suppose that does make sense but at least it's available if somebody decides they want to enable it and it does make sense in their situation. Yay! Everyone wins.

https://support.plesk.com/hc/en-us/articles/115000490174-Is-it-possible-to-use-Let-s-Encrypt-for-wildcard-certificates-

@cPanelFelipe My main application is I develop lot's of sites using WordPress Multisite, and I develop using a wildcard subdomain, then will map a primary domain later down the line. The backend will often be accessed by the subdomain. So for my workflow, I have to create a subdomain entry (which I wouldn't have to do with wildcard) to trigger AutoSSL to create a certificate for the subdomain, then that certificate takes up space in my allowable certificates, especially if I use LE with their 100 site limitation. So my workflow with wildcard SSL would eliminate the need to artificially create a subdomain (that serves no other purpose than to trigger AutoSSL) and would reduce the number of certificates I need by half-1. So if I had 100 sites now I have to have 200 SSL certificates from Comodo, with wildcard subdomains I would have just 101 certificates. That is my perspective. Also part of my future business model is offering sites with a subdomain on my network and then upselling to a TLD, this would make it much, much easier to automate.

Just a clarification: cPanel is not opposed at all to supporting free wildcard certificates. My description of the challenges that the new API version poses was meant merely to give a bit more context as to why it’s not as simple as we’d like it to be for us to have AutoSSL’s LE provider request wildcard certificates.

Jeremy: Web hosting via wildcard domains (e.g., WP Multisite) does seem to be the principal area where AutoSSL can’t (currently) provide coverage. cP management is aware of the desire to support this use case. I’ve been trying to research what other use cases wildcard AutoSSL support would fulfill that AutoSSL (either the default provider or LE) currently can’t do.

What do you mean by “allowable certificates” and “100-site limitation”? LE limits individual certificates to 100 domain names, but AutoSSL’s LE module will just request as many certificates as are needed to secure all needed domains.

Hello,

One of my main purpouses for wanting wildcard domains is to support wildcard https redirects.

At the moment I can setup a redirect for all http traffic at any random sub domain to go back to my home page, however if I try that same thing using a https request it will fail.

Also, it would be very handy to create a wildcard cert in CPanel and then have the ability to export it to use elsewear on self hosted servers or such.

Thanks,

Mike

It might be my misunderstanding of LE's limitations, but I understood that LE could only provide certificates for 100 sites. I have seen this in practice that AutoSSL will stop issuing new certificates after 100 domains (using LE as the provider), that is why I switched to using default Comodo with AutoSSL.

In my case a wildcard subdomain SSL would cover any subdomain of the main site which is how WordPress Multisite is designed to work, thereby eliminating a large number of un-needed certificates. That was the point I was trying to make, so I get that you guys have that under consideration (thanks for that) I just thought that AutoSSL through LE was limited to 100 domains and that it treated subdomains as individual domains.

I'm developing a marketplace with dynamic subdomains per seller. It's quite similar to the WP multisite feature mentioned above. I would REALLY like to see this implemented.

Thanks!

Thanks for that context. That's certainly an interesting use case. Unfortunately, adding WildCard support for Let's Encrypt isn't on the plan for 2019 yet. If that changes, we'll be back to let everyone know!

Youpee !!! :)