The Common Name (CN) in a TLS certificate is documented to have a limit of 64 chars.
The trick when issuing a cert for a so long subdomain is to set the CN to something else (shorter) and have the certificate to certify multiple domains, as the Subject Alternative Names (SAN) are allowed to be longer.
When you setup an https Caddy server, it works out for you the full negotiation with let's encrypt so you don't have to manually resolve the challenges.
But when the caddy server has a long domain, it fails to set all up as the text intended for the CN is too long.
For example
If you have this in the Caddyfile:
long-name-test.that-exceeds-max-common-name-allowance.frontend-ping.my-nice-domain.com {
respond "SSL Test for checking how to handle long common names that exceed 64 chars"
}
Then your caddy logs will say:
# TL;DR = "CSR doesn't contain a SAN short enough to fit in CN"
{
"level":"error",
"ts":1601630649.1419806,
"logger":"tls.obtain",
"msg":"will retry",
"error":"[long-name-test.that-exceeds-max-common-name-allowance.frontend-ping.my-nice-domain.com] Obtain: [long-name-test.that-exceeds-max-common-name-allowance.frontend-ping.my-nice-domain.com] finalizing order https://acme-staging-v02.api.letsencrypt.org/acme/order/13716260/160342164: request to https://acme-staging-v02.api.letsencrypt.org/acme/finalize/13716260/160342164 failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:badCSR - Error finalizing order :: CSR doesn't contain a SAN short enough to fit in CN (ca=https://acme-staging-v02.api.letsencrypt.org/directory)",
"attempt":2,
"retrying_in":120,
"elapsed":65.394715932,
"max_duration":2592000
}
The error is natural and expected: Trying to set a longer-than-64-chars CN which is not allowed.
Now the question is
Assuming
- that the long CN comes from a long subdomain
- and that I also own the domain which would accept another short subdomain
- and that all them are controlled by caddy
Q: How can I instruct the Caddy Server to make a long subdomain/domain to have a "shorter CN"?
For example tell caddy that for this:
long-name-test.that-exceeds-max-common-name-allowance.frontend-ping.my-nice-domain.com
to use this:
CN=short.my-nice-domain.com
SAN=long-name-test.that-exceeds-max-common-name-allowance.frontend-ping.my-nice-domain.com
and also get TSL automatically negotiated instead of me reolving the challenges?
