1

I've got a Plesk setup which issues Letsencrypt certificates and hosts part of my client websites. When passing the _acme-challenge and receiving a wildcard certificate / installing said certificate it seems that part of the subdomains which aren't hosted with me still give a certificate error.

My setup in the DNS is currently as follows:

  • example.com - A informational website hosted on my Plesk server.
  • dev.example.com - A separate dev site hosted on another IP address eg 192.0.2.12
  • live.example.com - Another application entirely, hosted by me and working with the current SSL

As far as I understand this, the other party from dev.example.com also needs to install a wildcard certificate on their end? Or is there something wrong with my certificate itself.

2
  • 1
    "Or is there something wrong with my certificate itself." No one can know since you are not showing the real names (and please do not obvuscate badly, use example.com if you really need a placeholder but this will severely reduce the rate of useful replies) nor the certificate concerned. A certificate cover a set of names. So "it seems that part of the subdomains which aren't hosted with me still give a certificate error." is expected if you mean by that names that are not in the set the certificate covers. – Patrick Mevzek Sep 8 '20 at 15:00
  • Should I add the .cert file to my question? Or how do you mean the certificate itself? I can change the domain names if needed. And by using a wildcard certificate it should cover all subdomains right? Even if I were to make a test.example.com it'd work. At least that's my understanding of certificates – RDAxRoadkill Sep 9 '20 at 8:10
1

A certificate has to be installed on every web server hosting content for the domain. The wildcard certificate you obtain and install on your server will only cover subdomains hosted on your server. If your client has a subdomain hosted by a third party, that third party would need their own certificate.

The dev subdomain doesn't have to have a wildcard certificate. It could have a non-wildcard certificate that only covers dev.example.com which is obtained separately from the wildcard certificate that Plesk gets. In other words, the company hosting the dev subdomain could use the HTTP challenge protocol to get a LetsEncrypt certificate without having any access to your server or DNS.

Another option would be for your client to copy the certificate, private key, and chain from the Plesk server to the server for the dev domain. I would not recommend doing so unless they could automate the process. LetsEncrypt certificates expire every three months. Relying on manual copying for such short lived certificates is not usually reliable enough.

1
  • I see. I probably worded my question wrong in this case, but thank you for your clear and concise answer. I'll let the third party know that they will need to install a certificate themselves. Thank you! – RDAxRoadkill Sep 9 '20 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.