Nate_pad you asked about Hetzner specifically. Their cloud servers don't include SSL management, you bring your own. The Load Balancer does but it's separate product. Just so you know what you're pricing.
SSL for 50 subdomains: wildcard or individual?
nate_pad
Member OP
Thanks everyone this is so helpful! I think I'll go with wildcard + Hetzner firewall + storing key properly. Maybe later when I have money for the Load Balancer I'll switch to that. One more thing - how do I actually get the wildcard cert? Do I need to prove I own the domain every time it renews? I used https://letsencrypt.org for that.
arjundirect
Member
nate_pad said:
Do I need to prove I own the domain every time it renews?
Basically yes sir/ma'am, wildcard requires DNS-01 challenge basically you create a TXT record in your DNS. So basically you need API access to your DNS provider. Hetzner has DNS hosting but I am not sure if they have API, basically you should check. Sorry for not knowing.
harbourops
Member
Hetzner DNS does have an API. You'll want certbot with the certbot-dns-hetzner plugin, or acme.sh with Hetzner DNS support. Both automate the TXT record creation.
Set up a restricted API token, scope it to just that zone. Test the renewal with --dry-run before you go live.
This was covered in the first few replies but the thread drifted, which is normal.
Same here. Wildcard + automated DNS on Hetzner. Running 60+ subs for a SaaS side project, no issues in two years. Key is in /etc/letsencrypt with strict permissions, app reads it read-only.