Because this is a common perspective, I want to make it very clear why supporting https for .onion
domains is important: it makes sense to add an https cert for Onion Services when adding a .onion
domain as an alias to an existing, complex site that has http -> https redirects buried everywhere
Personally, I'm trying to add a .onion
as a secondary domain for all my existing wordpress sites. Years ago, I migrated from http to https when Let's Encrypt first came out. When I made that transition, I checked all the boxes to "redirect http to https" everywhere I could: in my web server's config, in the caching reverse proxies, in the CMS core config, in various plugins, themes, etc. Now that I'm trying to add a .onion
to my existing websites, I'm finding that some of my sites work OK, but others stubbornly refuse to serve traffic over http. They just 301 redirect to https://xyz.onion
(which of course doesn't work). Isolating and changing this behavior is non-trivial, especially for large sites.
There's huge privacy benefits to be gained by site admins making their existing websites accessible to tor users through onion services, but--since all our great efforts to migrate from http to https in the past years--it's not always trivial to just point a .onion
at a website and have all the infrastructure we hardened just accept serving over http again.
If ACME could support issuing certs for .onion sites, this would lower the barrier of entry for sysadmins to be able to bring their existing websites onto the tor network, which would be another huge benefit for the privacy of Internet users everywhere.
See also: