Dynamic Multi-domain Support?

[FractalMind]

Good day, you have an awesome project going on here.

We are using a multi-tenant website builder. Meaning: multiple domains can be linked to ONE web server and it will display the correct webpage according to the domain detected.

I'm looking for an automatic SSL generation system that can route an infinite amount of websites to ONE container that has that multi-tenant webserver.

Eg: 
exemple1.com, exemple2.com, exemple3.com, exemple4.com => (container01 with multi-tenant server) 

Would it be possible to use your system to route an infinite amount of domains to ONE container?

Thank you for your time.

[xicond]

Yeah, I think we can use idea of wildcard domain, but the issue is the rate limit

[FractalMind]

Not sure but I think the limit is "by email". If you make a request with your tenant email should be good. Not sure though

[buchdag]

I'm not entirely sure about what you're asking here. nginx-proxy/acme-companion does not do any proxying by itself, it's just an automated ACME client meant to work with nginx-proxy/nginx-proxy (which handle the actual proxying).

From this project's point of view:

• "an infinite amount" is not a quantity I'll be able to answer about. Software is about finite quantities, in your case is it 50, 100, 1 000 10 000 or more domains per container ? What is the order of magnitude ?
• On Let's Encrypt there is a hard limit of 100 domains per SAN certificate if you plan to use them. I believe most CAs put a limit on this around 100/150 domains per certificate. That can be circumvented by issuing single domain certificates only.
• This project is not really fit for handling certificates numbering in the thousands and up, see Slow cycle #839. Even if the situation described in this discussion can be optimised (and probably will be in the coming year), this is still single threaded bash automation, which has its limitations.
• As mentioned by @xicond, if you use Let's Encrypt you'll have to handle rate limiting. As the docs explains, the main limit is 50 registered domains / week (I don't know if this limit is by account either, @cpu ?). Other ACME CAs such as ZeroSSL don't have rate limiting and this project also supports them.

From nginx-proxy/nginx-proxy point of view, I have no idea what the upper limit in terms of domains handled would be.

[cpu]

if you use Let's Encrypt you'll have to handle rate limiting. As the docs explains, the main limit is 50 registered domains / week (I don't know if this limit is by account either, @cpu ?)

If you're talking about the "Certificates per Registered Domain (50 per week)" rate limit from the docs it is not per-account if my memory serves me.

@buchdag As an aside, I haven't worked for Let's Encrypt for ~1.5yrs. I happened to catch this @ but won't be the best person to tag for questions generally. I recommend using the community forum :-)

[buchdag]

As an aside, I haven't worked for Let's Encrypt for ~1.5yrs. I happened to catch this @ but won't be the best person to tag for questions generally. I recommend using the community forum :-)

I was wondering that when I clicked Reply, sorry if that was inconvenient. Glad to see you're still out there though 😺