Home » Posts tagged "wildcard"

Let's Encrypt 的 Wildcard Certificate 開放使用!

Twitter 上看到這則 tweet,Let's Encrypt 正式開放 Wildcard Certificate 了:

參考「ACME v2 and Wildcard Certificate Support is Live」這邊的說明,裡面有提到 Wildcard Certificate 需要有 ACMEv2 的 client:

Wildcard certificates are only available via ACMEv2. In order to use ACMEv2 for wildcard or non-wildcard certificates you’ll need a client that has been updated to support ACMEv2. It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet.

翻了一下「ACME Client Implementations」,我常用的 dehydrated 也支援 ACMEv2 了,而且剛好前幾天我更新了 PPA (參考「PPA for dehydrated : Gea-Suan Lin」),把最新版 (0.5.0 後的 6e802dd) 包進去了,等下來測試看看要怎麼玩 XDDD

然後我之後打算把 letsencrypt.tw 的資料改丟到我的 Wiki 上,這樣改起來比較簡單...

Let's Encrypt 的 Wildcard Certificate 將會再延...

先前有提到 Let's Encrypt 的 Wildcard Certificate 從一月延到二月底 (表訂 2/27,參考先前的「Let's Encrypt 的 Wildcard SSL Certificate 延至二月底推出」這篇),今天想說歐美的時區也差不多要過完 2/27 了,結果翻資料發現在「ACMEv2 and Wildcard Launch Delay」這邊又宣佈延期了,這次也不給時間了 XDDD

主要是 TLS-SNI 認證方式的前提有問題,導致 Let's Encrypt 臨時調度人力處理這個包 (可以參考「2018.01.09 Issue with TLS-SNI-01 and Shared Hosting Infrastructure」這篇,裡面有提到共用產生的問題假設):

The biggest reason for this delay is the recent TLS-SNI deprecation. This unexpectedly pulled most engineering resources away from ACMEv2 and wildcard support for approximately two weeks.

然後 2/27 的說明提到目前是沒什麼大問題,但目前還在 QA 階段,然後目前先不給 release date:

Feb 27 Update: There are no known major issues with the ACMEv2/wildcard test endpoint. ACMEv2 and wildcard support quality assurance is continuing. No release date to announce yet.

就只能繼續等了... XD

Let's Encrypt 的 Wildcard SSL Certificate 延至二月底推出

Let's Encrypt 本來預定在一月底時推出 Wildcard SSL Certificate (參考「Let's Encrypt 決定要規劃 Wildcard SSL Certificate 了」),昨天突然想到應該是要推出了... 查了資料發現在原本的公告文章上宣佈延到二月底了:「Wildcard Certificates Coming January 2018」。

Update, January 4, 2018

We introduced a public test API endpoint for the ACME v2 protocol and wildcard support on January 4, 2018. ACME v2 and wildcard support will be fully available on February 27, 2018.


Let's Encrypt 決定要規劃 Wildcard SSL Certificate 了

Let's Encrypt 把時間表喊出來了,預定在 2018 年年初開放使用:「Wildcard Certificates Coming January 2018」。

Wildcard SSL Certificate 會需要走新的 ACME v2 協定認證:

Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only support base domain validation via DNS for wildcard certificates, but may explore additional validation options over time.

跟前陣子提到的「ACME v2 API Endpoint Coming January 2018」是相同的時間。


StackOverflow 預設全上 HTTPS 了...

HTTPS Everywhere 沒什麼感覺,但對於一般人應該不簡單,所以 Nick Craver (根本就是他們家非正式的 PR Engineer XDD 他這幾年寫了不少內部的資訊...) 寫了一篇關於上 HTTPS 的故事:「HTTPS on Stack Overflow: The End of a Long Road」。

其中他們為了支援舊設備 (沒有支援 SNI 的),決定直接把所有 wildcard 類的 SSL certificate 都包進去 (另外找 DigiCert 處理):

然後中間提到這個真的頗無奈的,抱怨 SVG 的 XML... XDDD:

Finding and killing these was a little fun because you can’t just search for "http://". Thank you so much W3C for gems like this:

<svg xmlns="http://www.w3.org/2000/svg"...

一條辛苦路 XD

奇怪的 Wildcard SSL 取得方式...

在「VMBox.co – 2GB OVZ w/ 2 Free Wildcare SSL @ $5/m」這邊看到的,租 VPS 送兩個 wildcard SSL certificate:

Up to 2 free wildcard SSL available per VPS order in Phoenix or Amsterdam. SSL only to be used on Singlehop network.


WildCard AlphaSSL Certificate - $0.00 USD Free Account
Please note these SSL's are only to be used on our network. They won't be guaranteed if used elsewhere.

不過除了 revoke 以外,想不到其他方式... 所以只要有合約在應該都是生效的?

如果是這樣的話,USD$40/year 就可以買兩個 wildcard SSL certificate 了?比起現在的各家 wildcard SSL certificate 都還便宜...

CA/Browser Forum 在三月底的會議記錄

CA/Browser Forum 三月底的會議記錄裡看到了關於 wildcard ssl certificate 的一些討論,還蠻有趣的:「2016-03-31 Minutes」。

主要是第五條的記錄,在討論更廣泛的 wildcard 用法。首先是 Microsoftww*.example.com 這種 domain 的認定:

Rick said there was a Microsoft tech note that allows ww*.example.com. Jody confirmed the platform supports it.


Rick suggested the BRs be updated to include that. Ryan said that is not a good thing as there are multiple specs that treat this differently and historical context which would make it hard for Google to support such a ballot. Kirk asked why Peter put this in the ballot. He responded that this was raised in the past where people found a discrepancy in relation to other docs. However, given there was not consensus, he would remove from the proposed ballot. Ryan said there is a need for clarification because CAs seem to be interpreting this differently. Peter said he would create a new definition called “wildcard domain name” with an exact definition to avoid confusion and add clarity. Rick said that ideally Microsoft should remove that functionality and update the tech notes. Jody said he would need to consult with his expert on this. Peter said the goal of this ballot was to make it a “consensus” ballot and would remove anything controversial.

看起來還沒有完全定下來,之後的會議記錄可以再看看進展。這對安全性也頗有幫助,舉例來說,我就可以針對不同的服務發不同的 wildcard ssl certificate,像是 test-*.example.com 這樣,而不用另外再建立機制避免 private key 的外流。

WordPress.com 將全面提供 HTTPS 服務

WordPress.com 宣佈將全面提供 HTTPS 服務:「HTTPS Everywhere: Encryption for All WordPress.com Sites」。

其中 wordpress.com 應該是買 wildcard SSL certificate 來做,而 custom domain 的部份將會透過 Let's Encrypt 來做:

The Let’s Encrypt project gave us an efficient and automated way to provide SSL certificates for a large number of domains. We launched the first batch of certificates in January 2016 and immediately started working with Let’s Encrypt to make the process smoother for our massive and growing list of domains.

這包括了對 SPDY + HTTP/2 的支援,使得 HTTPS 的速度不比 HTTP 差 (甚至更快)。

CloudFront 支援 Wildcard Invalidation

在「Amazon CloudFront Makes it Easier to Invalidate Multiple Objects」這邊看到的消息,Amazon CloudFront 總算是支援 Wildcard Invalidation 了。價錢與 Single Object Invalidation 相同,都是每次 USD$0.005。

依照 Invalidating Objects (Web Distributions Only) 這邊的說明,Wildcard 的部份只能用在結尾:

To invalidate objects, you can specify either the path for individual objects or a path that ends with the * wildcard, which might apply to one object or to many, as shown in the following examples:

  • /images/image1.jpg
  • /images/image*
  • /images/*

不過還是有些限制,包括了 Single Object Invalidation 的同時最多 3000 條的限制:

If you're invalidating objects individually, you can have invalidation requests for up to 3,000 objects per distribution in progress at one time. This can be one invalidation request for up to 3,000 objects, up to 3,000 requests for one object each, or any other combination that doesn't exceed 3,000 objects. For example, you can submit 30 invalidation requests that invalidate 100 objects each. As long as all 30 invalidation requests are still in progress, you can't submit any more invalidation requests. If you exceed the limit, CloudFront returns an error message.

以及 Wildcard Invalidation 的同時 15 條限制:

If you're using the * wildcard, you can have requests for up to 15 invalidation paths in progress at one time.

而且每次 invalidate 可能都要 10~15 分鐘:

It usually takes 10 to 15 minutes for CloudFront to complete your invalidation request, depending on the number of invalidation paths that you included in the request.

所以也不是付錢就可以解決所有事情... :o