<html><head></head><body><div class="gmail_quote">On January 20, 2016 9:14:18 PM EST, "B.S." <bs27975@yahoo.ca> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Help me understand this.<br /><br />As far as I knew, every cert gets cross-checked back to the cert issuer for authenticity.<br /><br />If you use the same cert on different services, presumably with different names ... wha?<br /><br />(Not to say SNI isn't also the answer, but it doesn't seem intuitively so, here, for Bob's use case.)<br /><br />e.g. <a href="http://www.sobac.com">www.sobac.com</a>, <a href="http://xmpp.sobac.com">xmpp.sobac.com</a>, <a href="http://myotherwww.sobac.com">myotherwww.sobac.com</a><br /><br />I can see a <a href="http://sobac.com">sobac.com</a> cert, and a setup where <a href="http://sobac.com">sobac.com</a> is authoritative for all 'domain' certs, but I'm guessing that takes some special setup, or options checkboxes, when creating the cert.<br /><br />Or a cert that's actually cert'ing one's own local CA?<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-l!
eft:
1ex;"><hr /><br /> From: Raymond Chen <raymondchen625@gmail.com><br />To: KWLUG discussion <kwlug-disc@kwlug.org> <br />Sent: Wednesday, January 20, 2016 2:17 PM<br />Subject: Re: [kwlug-disc] Let's Encrypt<br /> <br /><br /><br />I think the solution of your 'one cert to one web server' problem is SNI(Server Name Indication). On the server side, many web servers support that e.g. Apache. But it also requires browser support, here is a browser compatibility table I found: <a href="http://caniuse.com/#feat=sni">http://caniuse.com/#feat=sni</a><br /><br /><br />On Wed, Jan 20, 2016 at 12:31 PM, Bob Jonkman <bjonkman@sobac.com> wrote:<br /><br />-----BEGIN PGP SIGNED MESSAGE-----<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Hash: SHA1<br /><br />Has anyone used a single Let's Encrypt cert for multiple services? For<br />example, I've got one domain, <a href="http://sobac.com">sobac.c!
om</a>
which hosts e-mail, XMPP and a<br />Web site. Is it possible to use the same cert for all those services<br />under the same domain?<br /><br />Has the problem of virtual web servers been solved? Last I heard it<br />was only possible to apply one cert to a web server. A web server that<br />hosts multiple domains couldn't use a Let's Encrypt cert -- is this<br />still true?<br /><br />I would like to see a presentation/demonstration on acquiring and<br />installing a Let's Encrypt cert on a variety of services...<br /></blockquote></blockquote><br /><br /><hr /><br />kwlug-disc mailing list<br />kwlug-disc@kwlug.org<br /><a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br /><br /></pre></blockquote></div><br clear="all">For each h domain name you run the letsencrypt protocol again. But if you have vhosting you can do it all in one command:<br>
<br>
$ letsencrypt standalone --certonly -d <a href="http://xmpp.sobac.com">xmpp.sobac.com</a> -d <a href="http://sobac.com">sobac.com</a> -d <a href="http://www.sobac.com">www.sobac.com</a><br>
<br>
The machine you run that on must be where DNS resolves to for all those domains, of course.<br>
<br>
letsencrypt's tracker has requests for wildcard domains and sub-CAs, bit they are holding back on that. If they get it properly automated then the need for wildcard domains disappears, since its just an extra command line while you're sysadminning, and big services like tumblr can gen a cert when someone makes a new account.<br>
-- <br>
Nick Guenther<br>
4B Joint Stats/CS<br>
University of Waterloo</body></html>