Martin M martinm82

Recently, Let's Encrypt launched free wildcard certificates. While this is good news in and of itself, as it removes one of the last remaining reasons for expensive commercial certificates, I've unfortunately seen a lot of people dangerously misunderstand what wildcard certificates are for.

Therefore, in this brief post I'll explain why you probably shouldn't use a wildcard certificate, as it will put your security at risk.

A brief explainer

It's generally pretty poorly understood (and documented!) how TLS ("SSL") works, so let's go through a brief explanation of the parts that are important here.

The general (simplified) idea behind how real-world TLS deployments work, is that you:

An Ansible summary

Jon Warbrick, July 2014, V3.2 (for Ansible 1.7)

Configuration file

intro_configuration.html

First one found from of

	{
	"version": "3.0.0",
	"build_id": "manual",
	"aws_access_key": "PASS THE KEY WITH -var 'aws_access_key=<YOUR_KEY>'",
	"aws_secret_key": "PASS THE KEY WITH -var 'aws_secret_key=<YOUR_KEY>'",
	"ebs_encrypt_cmk_alias": "packer-ami-ebs",
	"ami_name": "My Ubuntu 18.04",
	"encrypt_boot": "true",
	"ami_tag_author": "the author",
	"instance_type": "t2.micro",

	Vagrant.configure("2") do \|c\|
	c.berkshelf.enabled = false if Vagrant.has_plugin?("vagrant-berkshelf")
	c.vm.box = "bento/ubuntu-16.04"
	c.vm.hostname = "ubuntu-1604"
	c.vm.synced_folder ".", "/vagrant", disabled: true
	c.vm.provider :virtualbox do \|p\|
	p.customize ["modifyvm", :id, "--memory", "2048"]
	p.customize ["modifyvm", :id, "--cpus", "2"]
	p.customize ["modifyvm", :id, "--audio", "none"]
	end