Can DNS be used alongside ALPN? about certmagic HOT 5 OPEN

You could probably do this yourself, but it's very odd indeed. You'd probably have to fiddle with a config/setup that works, unfortunately I don't have the time for that right now. What would you do if you get a cert for a subdomain -- just stop trying to get a wildcard cert?

Can you elaborate more on this:

However, it's still relatively slow when getting certs for new subdomains

from certmagic.

What would you do if you get a cert for a subdomain -- just stop trying to get a wildcard cert?
No, I'd want to switch to using the wildcard cert ideally.

Can you elaborate more on this:

However, it's still relatively slow when getting certs for new subdomains

Some more context might clarify things a bit. I'm building a tunnel service, a la ngrok or Cloudflare Tunnel. This is something of an ongoing interest of mine0. My service will hand out subdomains on wg8.org, so for example I could claim anders.wg8.org.

Once that control has been delegated, I'll want to manage the certs myself on the client side in order to get e2ee. I'll also want to run a number of apps, such as jellyfin.anders.wg8.org, nextcloud.anders.wg8.org, etc. When using on-demand certs, the first visit to each domain takes about 2-5 seconds before the cert is acquired. If I used dns-01 immediately after gaining control of anders.wg8.org, those would all be instantaneous. I could also use ManageAsync after the user sets up the subdomain for a given app, but typically the first thing they want to do is immediately open/be redirected to the app so that might not improve things much.

There are also rate limiting concerns here. I'm planning to get wg8.org added to the public suffix list, but until that's done I'm concerned we'll be hitting Let's Encrypt rate limits much sooner.

from certmagic.

So to make sure I understand, the primary concern is that your first connection is going to take a couple of seconds?

(Sorry for the late reply. Busy times!)

from certmagic.

No worries! I would say concern is equality distributed between the couple seconds it takes, but also that the time it takes is fairly variable. Sometimes Let's Encrypt is slow.

from certmagic.

@anderspitman Instead of PSL, have you considered filing a rate limit exemption request with Let's Encrypt? They have a form for use cases like yours.

from certmagic.