Member OP
Hi sorry total noob here 😅 I have about 50 subdomains for my app and need ssl. Should I get individual certs or a wildcard? My host is Hetzner. Sorry if dumb question. Each subdomain is for a different user so they get created dynamically. I heard wildcard covers all of them but not sure how it works. Please help and sorry for bothering!
50 individual certs would destroy my margins with my customers. Let's Encrypt wildcard is free and covers unlimited subdomains. Have you looked at that? 'Sara's Crafts'
Member
Sorry if dumb question sir/ma'am, basically I used to run a multi-tenant app too and basically the problem with wildcard is that all your tenants share the same private key. So basically if one subdomain gets compromised they all do. Please help and sorry for explaining so much but basically this is an architecture issue not just a cert question. Sorry again.
Member
Best practices for multi-tenant SSL:
Recommended architecture:
Your current design conflates DNS automation with cryptographic isolation. Address the tenant boundary first, then select certificate strategy.
I've been running about thirty client sites on Hetzner out of Falkenstein for a couple of years now.
Shared key means one breach kills everything?
50 subs? I respect the grind fr
Member
Yes. The wildcard private key signs the cert for *.yourdomain.com. Anyone with that key can impersonate any subdomain. With individual certs, a breach only exposes that one tenant's traffic.
That said, "compromised" usually means your server is rooted, at which point you're already in deep trouble either way. The isolation is more about limiting blast radius and revocability.
Let's Encrypt rate limits are 50 certs per registered domain per week. With 50 subs you're already at the edge, and if you're creating them dynamically you'll hit that wall fast. Wildcard avoids the limit entirely since it's one cert.
I run about 40 subs on one wildcard for my reseller customers in Phoenix. Never had an issue.
Member
Basically sir/ma'am sorry but Let's Encrypt free tier has rate limits basically 50 per domain per week as hankels said. So basically if nate_pad creates more than 50 per week or needs to reissue, basically they are stuck. Sorry for pointing out.
Member OP
Oh no I didn't know about rate limits! My app could definitely make more than 50 in a busy week. So wildcard is basically my only option? But then the shared key thing scares me. Is there a middle ground?
