2

My company manages well over 1000 sites for various clients. Currently, we are paying for a Standard DV certificate for each individual site ($94.99 from GoDaddy). We are easily spending over $100k per year on SSL certificates alone.

I know there has to be a better option when securing this many websites. From GoDaddy, there is an option for using their ACME Server and automating it, is this feasible for the amount of sites I have? Should I be using a wildcard cert for our company to secure our client sites?

Improve this question
2
  • Are your sites on shared hosting or a dedicated server (or VPS)?
    – Steve
    Commented Apr 15, 2021 at 21:48
  • It seems "best" is defined in your case by "Less costly" so you should say so in your title because otherwise "best" is subjective not knowing the criteria and the question can be closed as "Opinion based".
    – Patrick Mevzek
    Commented Apr 16, 2021 at 1:14

1 Answer 1

Reset to default
3

Moving to a system using acme (or DNS if your systems have the hooks) and using Letsencrypt will likely the way to go. Certbot makes this easy. Total cost for certs is your time setting it up as a one off - no ongoing costs or manual cert installs and wide acceptance. Letsencrypt/Certbot doing ACME challenges is the way to go, is viable for 1 cert upwards - I've got several hundred and its more-or-less set and forget.

Wildcard certs will only work well if you have subdomains - eg abc.example.com / xyz.example.com.

Im not sure why you would be paying $95 for a DV cert. The going rate is about $10/year. Letsencrypt are, of-course free and widely supported.

Improve this answer
7
  • 3
    Using LetsEncrypt at that scale isn't trivial. LE imposes a rate limit of 50 certificates per week per account. It would take 20 weeks to generate 1000 certs with one account. You might be able to get around that by using multiple accounts or grouping 20+ clients into each SAN certificate. It isn't impossible, but it will be somewhat frustrating.
    – Stephen Ostermiller ♦
    Commented Apr 16, 2021 at 8:52
  • 1
    @StephenOstermiller My interpretatiin of that link is virtually the opposite of yours. That only applies for subdomains. In fact it specifically states "Renewals are treated specially: they don’t count against your Certificates per Registered Domain limit" and "We’ve also designed them so renewing a certificate almost never hits a rate limit, and so that large organizations can gradually increase the number of certificates they can issue without requiring intervention from Let’s Encrypt."
    – davidgo
    Commented Apr 16, 2021 at 10:17
  • @StephenOstermiller Oh wow, I didn't know about that rate limiting, that would definitely make it more difficult.
    – Zach
    Commented Apr 16, 2021 at 12:40
  • @davidgo It was not my doing that led us to using the company that we did for DV's, I'm just trying to fix it. I think I will consider this as my most viable option thus far. I can request a higher rate limit it looks like from the link posted earlier as well.
    – Zach
    Commented Apr 16, 2021 at 12:50
  • I think you should be able to easily get around those rate limits, but keep them in mind. I've seen plenty of reports of people hitting the limits accidentally.
    – Stephen Ostermiller ♦
    Commented Apr 16, 2021 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.