4

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI.

What I mean is, with the proliferation of the cloud, almost every web-site owner, even with the smallest possible web-site, has their own IPv4-address. However, every such owner may have several unrelated web-sites on a given IPv4 address as above.

Currently, it would appear that the CA cartels make it cost prohibitive to obtain a single certificate with several distinct CNs specified, making it cheaper to rent extra IPv4 addresses if non-SNI clients must be supported. Will Let's Encrypt be the same, or do they plan to support multiple unrelated CNs per certificate, avoiding the need for a choice between SNI and IPv4-address waste?

cnst
  • 1,884
  • 2
  • 19
  • 30

2 Answers2

3

According to the post (dated 2015-09-09) in the subjectAltNames certificates thread: yes, subjectAltNames for unrelated domains will be allowed.

Update (from more recent posts in the thread links above):

Users report practical success in generating certificates with multiple domains. There is apparently a limit of 100 names per certificate.

Peter Green
  • 4,918
  • 1
  • 21
  • 26
1

Currently, it would appear that the CA cartels make it cost prohibitive to obtain a single certificate with several distinct CNs specified, making it cheaper to rent extra IPv4 addresses if non-SNI clients must be supported. Will Let's Encrypt be the same, or do they plan to support multiple unrelated CNs per certificate, avoiding the need for a choice between SNI and IPv4-address waste?

From the discussion at https://groups.google.com/a/letsencrypt.org/forum/#!topic/client-dev/2L_7-QN8cGE it seems that they are aware of this issue and that at least the protocol itself supports generation of certificates for multiple domains. If it will be supported in the initial release we will see.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
  • 2
    groups.google.com is so horribly slow. :-( – cnst Jan 10 '15 at 08:20
  • 1
    @cnst Javascript overdose, because apparently serving plain HTML isn't "hype" enough for them. –  Jan 10 '15 at 18:45
  • Thanks for posting this link - I'd been looking everywhere for something like this. From my understanding, this suggests that a single certificate could be issued for a collection domains to share; e.g. `letsencrypt firstdomain.tld secondone.tld tertiary.tld` - is that how you read it? – indextwo Mar 12 '15 at 19:10
  • "could" yes, but "will" - I don't know. – Steffen Ullrich Mar 12 '15 at 19:16
  • @SteffenUllrich: now that the initial release was made, could you update the answer? – d33tah Dec 09 '15 at 10:44