should tls-acme-01 create a certificate per alias? #409

New Issue

adam · 2025-12-29T01:24:35+01:00

adam commented

2025-12-29 01:24:35 +01:00

Originally created by @dholth on GitHub (Jun 18, 2019).

I am working on an extended version of the hypercorn web server called snipercorn that understands ACME certificates. My dehydrated domains.txt says dingoskidneys.com www.dingoskidneys.com but only the second one gets a certificate in alpn-certs/. Then the web server receives a tls-alpn-01 request for dingoskidneys.com and fails to find a certificate with that filename.

It looks like I could do a few things. Symlink the altnames environment variable in a hook, or more likely update the web server to check domains.txt against the last altname on the line, since it already does something similar for the main certs.

It seems inconsistent that the first name on the line names the certs/ but the last name is used for alpn-certs/

Originally created by @dholth on GitHub (Jun 18, 2019). I am working on an extended version of the hypercorn web server called snipercorn that understands ACME certificates. My dehydrated domains.txt says `dingoskidneys.com www.dingoskidneys.com` but only the second one gets a certificate in alpn-certs/. Then the web server receives a tls-alpn-01 request for `dingoskidneys.com` and fails to find a certificate with that filename. It looks like I could do a few things. Symlink the `altnames` environment variable in a hook, or more likely update the web server to check domains.txt against the last `altname` on the line, since it already does something similar for the main certs. It seems inconsistent that the first name on the line names the certs/ but the last name is used for alpn-certs/

adam closed this issue

2025-12-29 01:24:36 +01:00

adam commented

2025-12-29 01:24:37 +01:00

@dholth commented on GitHub (Jun 29, 2019):

It looks like the script is indeed creating both certificates for www.example.org and example.org, but it verifies and cleans up in the wrong order?

It creates challenge certs for www.example.org and example.org, but deletes www.example.org before asking letsencrypt to request the www.example.org challenge. Possibly my server is buggy, investigating...

@dholth commented on GitHub (Jun 29, 2019): It looks like the script is indeed creating both certificates for www.example.org and example.org, but it verifies and cleans up in the wrong order? It creates challenge certs for www.example.org and example.org, but deletes www.example.org before asking letsencrypt to request the www.example.org challenge. Possibly my server is buggy, investigating...

adam commented

2025-12-29 01:24:37 +01:00

@dholth commented on GitHub (Jul 15, 2019):

It may be as simple as https://github.com/lukas2511/dehydrated/blob/master/dehydrated#L702

The altnames are alphabetized in the letsencrypt response

@dholth commented on GitHub (Jul 15, 2019): It may be as simple as https://github.com/lukas2511/dehydrated/blob/master/dehydrated#L702 The altnames are alphabetized in the letsencrypt response

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#409