Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They attempted to indicate wildcards there, but HN ate them. That should say "you haven't proven that you control either *.freewebhost.com or *.tekmol.freewebhost.com".

Now, I can definitely see there being a system where the owner of the root domain (eg, freewebhost.com) can set up something in their own .well-known directory that specifies that any subdomains can only declare certs for that specific subdomain, rather than being able to claim a wildcard, and then we can allow certs that sign wildcards in cases where such a limiter is not in place.

In any case, this would only solve the DNS auth hurdle, not the overall expiration hurdle.



    solve the DNS auth hurdle, not the
    overall expiration hurdle
That would already be a big step forward.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: