Question: How to issue wildcard certificates rather than exact subject name in OnDemand? about certmagic HOT 3 OPEN

I'm using a bodge, adding a ManipulateClientHelloName function for this. here's an example of how it could be used:

magic.ManipulateClientHelloName = func(name string) string {
    if canUseWildcard(name) {
        name = strings.TrimSuffix(name, "." + PAGES_DOMAIN)
        parts := strings.Split(name, ".")
        parts[0] = "*"
        name = strings.Join(parts, ".") + "." + PAGES_DOMAIN
    }
    return name
}

I'm not recommending this be used here by any means but as a stopgap it's working for me for now, though longterm I'd prefer this project be able to accommodate this situation

from certmagic.

@hazycora I've just committed b29d2a0 which adds a SubjectTransformer field to the certmagic.Config struct. In my tests I used it similarly to you:

magic.SubjectTransformer = func(ctx context.Context, domain string) string {
	if !strings.HasPrefix(domain, "*.") {
		parts := strings.Split(domain, ".")
		parts[0] = "*"
		return strings.Join(parts, ".")
	}
	return domain
}

Want to give that a shot and see if that does what you need?

Note that my implementation affects all (I think all?) code paths that manage certificates, including NON-on-demand configs, but it can, of course, be used with on-demand configs as well. Let me know what you think!

from certmagic.

I think I had this on a TODO list a while ago. I'll try to revisit it soon.

from certmagic.