Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Ah, TIL.

I was asking because right now my nginx/certbot setup requests a single certificate for all my domains, and I would like to have them separate.

(I'm sure you can do that with certbot, I just haven't tweaked my setup, yet)



I see. Yeah, I think CertBot does that because of limitations in Apache (and possibly nginx as well) with "virtual hosting".

So yeah, Caddy uses one name per certificate by default, and there's no way to change that.


A certificate can be issued for as many, or as few domains as you'd like.

Look at certbot's -d parameter, this does not have anything to do with nginx, apache, caddy or any other web server.


Is that also possible when using --nginx? Or only in "vanilla" mode?


The nginx autoconfiguration plugin has no influence on how many domains the certificate you're requesting will be valid for.

Example: We run a SaaS on our client's domains, so for every client, we have to run `certbot -d subdomain.client1.com,client1.ourdomain.com,staging.client1.ourdomain.com,...`

That means we run certbot with ~4 domains (we include staging and other subdomains) for each client we have. This is highly automatable.

Whether you use nginx autoconfiguration or not is up to you.


I don't understand you.

Does the nginx autoconfiguration allow separate certificates, or do you simply say "don't use that"?


No no, you should totally use separate certificates (for our SaaS that's crucial, otherwise we would let our competitors know who our entire client base is, if all the domains would be included in one certificate)

I don't know too much about certbot's nginx plugin, I don't use it and don't see the benefit to be honest, we ran into problems with it (it didn't work for us because our clients have to set up a CNAME DNS entry, and that domain has to be included in the certificate)

We simply run certbot without the nginx plugin, and then have a config template for new virtual servers in nginx, based on a template. Certbot's nginx plugin would mess with our config constantly, changing from version to version, leaving artifacts, and we didn't like that.


Thanks for the advice! I'll look at it all on the weekend.


Good luck! I'd also recommend splitting the config into multiple files, like it has been best practice for the last decades [1] (link goes to Arch (which I also recommend using) but the advice is not Arch specific)

[1] https://wiki.archlinux.org/index.php/Nginx#Managing_server_e...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: