Subject: [Acme] Enrollment of Wildcard certificates with ACME?

From: "Fabio Pietrosanti (naif) - lists" <[email-masked]>
Date: Tue, 28 Jul 2015 12:41:28 +0200

Hi all,

within the ACME specification, has been the Enrollment of Wildcard
certificate been taken in consideration?

At Tor2web software project, that require wildcard certificate to be
used, we'd really love to integrate automation of certificate setup with
ACME/LetsEncrypt.

-- 
Fabio Pietrosanti (naif)
HERMES - Center for Transparency and Digital Human Rights
http://logioshermes.org - https://globaleaks.org - https://tor2web.org -
https://ahmia.fi

---

From: yan <[email-masked]>
Date: Tue, 28 Jul 2015 11:11:05 -0700

https://github.com/letsencrypt/acme-spec/pull/97

---

From: Michael Richardson <[email-masked]>
Date: Tue, 28 Jul 2015 10:30:20 -0400

> certificate been taken in consideration?

That really seems out of scope.

1) If you have a wildcard certificate, then you don't need to enroll it for
   each machine, you just install it.

2) It seems impossible to validate in HTTPS that you own all of the possible
   (perhaps not yet existing) QNAMES under your label.

I think we need to avoid boiling the ocean here.
Maybe the resulting protocol can be used to keep a wildcard certificate
up-to-date after it is deployed.

    > used, we'd really love to integrate automation of certificate setup
    > with ACME/LetsEncrypt.

I can't understand how a wildcard certificate, like, "*.example.com"
could work for tor2web, so maybe you can explain your situation more.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [