In short, domains with '--' can not be issued certs from LetsEncrypt because they are interpreted as R-LDH domains (RFC5890). See http://www.faqs.org/rfcs/rfc5890.html section 2.3.1
LetsEncrypt recently changed their policy here: https://github.com/letsencrypt/boulder/pull/2976
A small change to hosting_alias_automatic_aliases() with stop replacing '-' with '--'.
I'm not sure of what the original desire was to replace '-' with '--'. This change would also change the aliases of sites when they are verified for users using this feature with no backwards compatibility.
I'll upload a patch later today.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | automatic_hosting-2915508-7.patch | 2.25 KB | helmo |
| #6 | 2915508-selectable_double_dashes_in_automatic_aliases-3.patch | 2.1 KB | kienan |
| #2 | 2915508-no_double_dashes_in_automatic_aliases.patch | 674 bytes | kienan |
Comments
Comment #2
kienan commentedComment #3
helmo commentedI've never really liked the looks of those double dashes, so +1 for this patch.
Breaking previous sites is a valid concern however. To be safe we'd have to make it configurable and let old installations default to the old behaviour.
Comment #4
memtkmcc commentedIt was intended as a way to clearly identify the extra, special aliases, and not confuse them with other subdomains with single dashes. But it could be done with some extra keyword instead of a double dash, perhaps, if we are going to change this. Making it look like a "normal" subdomain is not only a change which breaks old aliases, but also adds some confusion, in my opinion.
Comment #5
memtkmcc commentedBy the way, we should perhaps exclude these extra aliases from LE certs, by default? That way we don't need to worry about breaking LE certs auto-renewal.
Comment #6
kienan commentedHere's a patch which lets the behaviour and the dash replacement string be configured. Default behaviour is to replace dashes with '--'.
I find it's useful to have HTTPs on automatic aliases, but I could that it'd be a good thing to have it be optional (but outside the scope of this ticket).
Comment #7
helmo commentedLooks great... I only add a 'states' section to collapse the Dash substitute field when the checkbox is not selected. RTBC?
Comment #8
memtkmcc commentedLooks good to me. Thanks!
Comment #10
helmo commentedcommitted