Allow dynamic DNS services to register more certificates

[bonanza123]

Hi,

Today, I was trying to get a certificate for my server which uses the dynamic DNS server dynv6.com but I got the error messages that already too many certificates have been issued for all its (sub) domains which end with “dynv6.net”. It would be very good if for such services a different limit than for usual websites would exist.

Thanks for consideration.

[serverco]

They can, but they need to decided and enable that option ( so you need to persuade them, rather than LE )

[serverco]

To expand on the issue a little, below is a link to a previous comment on the topic.

@jsha

Let's Encrypt basis its rate limit on the "registered domain" portion part of the FQDN, based on the Public Suffix List. For www.example.com, that would be example.com. For www.example.appspot.com, that would be example.appspot.com (because appspot.com is a public suffix).

Most dynamic DNS services should probably be in the Public Suffix List, because that's what browsers use to prevent sites from setting cookies on each other. Otherwise, example.appspot.com could set and delete cookies from widgets.appspot.com. So, my first recommendation is to ask your dynamic DNS provider to add themselves to the Public Suffix List, which will have add-on security benefits.

So dynamic dns services that want to allow creation of (more) letsencrypt certificates for subdomains of theirs can request their root domains to be added into this list: - View the Public Suffix List