Lego: Wildcard certificates for http01 challenge

[suvsap]

Hi Team,

As per the doc, I have seen it's not possible to generate wildcard certificates for http01 challenge. Can you kindly let me know if this is possible by creating wildcard dns records and then create wildcard certificates? This is very important for us

$ cat thermeon.com.yaml
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: thermeon.com
  namespace: thermeon-webs-gateway
spec:
  acme:
    config:
    - http01:
        ingress: thermeon-webs-gateway
      domains:
      - ‘*.thermeon.com.au'
      - ‘*.thermeon.com'
      - ‘thermeon.com'
      - ‘*.thermeon.eu'
  commonName: 'thermeon.com'
  dnsNames:
      - ‘*.thermeon.com.au'
      - ‘*.thermeon.com'
      - ‘thermeon.com'
      - ‘*.thermeon.eu'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-production
  secretName: thermeon-tls

Thanks,
Suv

[ldez]

Hello,

certmanager is not lego:

• https://cert-manager.io/docs/
• https://go-acme.github.io/lego/

To get wildcard certificates, you have to use DNS-01 challenge, it is related to the nature of this challenge.
It's not a lego limitations, it's related to the specification of this challenge the Let's Encrypt policies.

So it's impossible for all the ACME Let's Encrypt clients to get a wildcard certificate without the DNS-01 challenge.

[cpu]

So it's impossible for all the ACME clients to get a wildcard certificate without the DNS-01 challenge.

I believe it is possible that an ACME CA could choose to issue wildcard certificates with a challenge mechanism other than DNS-01 (_though I don't know of any that exist!_). The link between the two is Let's Encrypt specific policy and not a product of the specification.

[ldez]

I never thought that if a server implementing ACME and also being a domain provider, it could, for the domains it manages, use the challenges TLS-ALPN-01 or HTTP-01 to produce a wildcard certificate.
It's a bit tortuous but it's a possibility.

Thanks for the precision :+1:

[suvsap]

Thanks @ldez and @cpu for your prompt response.

Can you kindly guide how to produce a wildcard certificate with http01 challenge for the below yaml? What we need to do?

$ cat thermeon.com.yaml
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: thermeon.com
  namespace: thermeon-webs-gateway
spec:
  acme:
    config:
    - http01:
        ingress: thermeon-webs-gateway
      domains:
      - ‘*.thermeon.com.au'
      - ‘*.thermeon.com'
      - ‘thermeon.com'
      - ‘*.thermeon.eu'
  commonName: 'thermeon.com'
  dnsNames:
      - ‘*.thermeon.com.au'
      - ‘*.thermeon.com'
      - ‘thermeon.com'
      - ‘*.thermeon.eu'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-production
  secretName: thermeon-tls

[ldez]

@suvsap once again:

• currently, with Let's Encrypt it's not possible to use HTTP-01 to create a wildcard certificate.
• lego is not certmanager, please open an issue on the right repository https://github.com/jetstack/cert-manager