Allow dynamic DNS services to register more certificates

[serverco]

To expand on the issue a little, below is a link to a previous comment on the topic.

@jsha

Let's Encrypt basis its rate limit on the "registered domain" portion part of the FQDN, based on the Public Suffix List. For www.example.com, that would be example.com. For www.example.appspot.com, that would be example.appspot.com (because appspot.com is a public suffix).

Most dynamic DNS services should probably be in the Public Suffix List, because that's what browsers use to prevent sites from setting cookies on each other. Otherwise, example.appspot.com could set and delete cookies from widgets.appspot.com. So, my first recommendation is to ask your dynamic DNS provider to add themselves to the Public Suffix List, which will have add-on security benefits.

So dynamic dns services that want to allow creation of (more) letsencrypt certificates for subdomains of theirs can request their root domains to be added into this list: - View the Public Suffix List