Question about using multiple certificates with subdomains about eotk HOT 3 OPEN

Hi there!

I would recommend researching how Certificates work, but you are shooting in the right direction.

The "dots" are fixed points, so you would need the certificate to cover three domains:

• fooequivalent.onion
• *.fooequivalent.onion OR bar.fooequivalent.onion; from what you say the latter sounds preferred.
• *.bar.fooequivalent.onion

...but (I apologise) I do not know if the HARICA process provides for Wildcard addresses on Onion subdomains, yet. I would be interested to learn how that goes.

You are correct to use hardmap secrets.d/foo.key foo.com bar - because the default "foo.com" rule for EOTK already matches *.foo.com and thus matches bar.foo.com; HOWEVER the only area where one has to become specific about this, is re: purchasing Certificates. :-)

It should (?) be possible to get HARICA to put all three into one cert, but I do not know and have never tried. I recommend contacting them, and please let me know how you get on.

Digicert would certainly be able to offer an EV cert for these three, but that would be expensive.

Hope this helps.

from eotk.

Hi @alecmuffett,

Thanks a lot for getting back to me. My question was primarily about whether eotk can work with multiple certificates in one project.

I see two reasons to get multiple instead of one. One would be if Harica doesn't support all those domains on one cert for onion addresses (that doesn't seem too likely, but I haven't checked yet), the other is the case where over time you realize you need to support more domains that aren't already covered by a wildcard.

It seems probable that the latter will happen in my case, so I'm wondering if I'll be able to deal with that without replacing the cert I got in the first place. Would I be able to add more certs to the eotk project to cover the new subdomains?

I know with bare nginx that's no issue, but I'd rather not deal with the problem on that level. So is there an eotk-level answer to this?

Thanks!
WK

from eotk.

Harica does allow for certs that include:
foonumber1.onion
*.foonumber1.onion
*.bar.foonumber1.onion
*.baz.foonumber1.onion.

You can't however get:
*.foonumber1.onion
*.bar.foonumber1.onion
*.foonumber2.onion

Anyway, an EOTK level solution to a situation where there are multiple onion certificates for multiple domains as well as subdomains in one project would be welcome!

from eotk.