Enhance Your SSL Management with Wildcard Certificate Reuse in Convox

Introduction

We are excited to announce a new feature in Convox that simplifies SSL management for your applications: the ability to reuse generated wildcard certificates. This enhancement allows you to create a single wildcard certificate and apply it across multiple Convox apps, streamlining your SSL certificate management and improving security.

What is a Wildcard Certificate?

A wildcard certificate is a digital certificate that secures a domain and its subdomains with a single certificate. For example, a wildcard certificate for *.mywildcarddomain.com would secure mywildcarddomain.com, www.mywildcarddomain.com, api.mywildcarddomain.com, and any other subdomains. This approach is highly efficient for managing SSL certificates across multiple subdomains, reducing administrative overhead and simplifying the SSL deployment process.

Benefits of Wildcard Certificate Reuse

The new feature in Convox allows you to reuse a generated wildcard certificate across multiple applications, offering several significant benefits:

Simplified Management: Generate a single wildcard certificate and reuse it across all your applications, reducing the complexity and administrative burden of managing multiple certificates.
Enhanced Security: Using a single wildcard certificate ensures consistent SSL encryption across your applications, minimizing security gaps and reducing the risk of misconfiguration.
Avoid Rate Limiting: By reusing wildcard certificates, you can minimize the number of certificates generated, helping to avoid rate limits imposed by Let's Encrypt or other certificate authorities.

Configuring Wildcard Certificate Reuse in Convox

To take advantage of the wildcard certificate reuse feature in Convox, follow these straightforward steps:

Step 1: Configure DNS01 Challenge for Let's Encrypt

Before generating a wildcard certificate, you must set up a DNS01 challenge for Let's Encrypt. This process involves proving domain ownership by creating a specific DNS TXT record. For detailed instructions, check our previous blog post on configuring Let's Encrypt DNS01 challenge with Route53.

Step 2: Generate a Wildcard Certificate

Once the DNS01 challenge is configured, generate a wildcard certificate using the Convox CLI:

$ convox certs generate *.mywildcarddomain.com --issuer letsencrypt

This command will initiate the process of creating a wildcard certificate for your domain.

Step 3: Check the Certificate Status

The certificate generation process may take a few minutes. You can check the status of the generated certificate with the following command:

$ convox certs --generated

The output will provide the certificate ID and its status, ensuring it's ready for use:

ID                                              DOMAIN                   EXPIRES              Status
cert-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx     *.mywildcarddomain.com   1 year from now      Ready

Step 4: Use the Generated Certificate in Your convox.yml

After confirming the certificate is ready, reference its ID in your convox.yml file to apply it to your app:

environment:
  - PORT=3000
services:
  web:
    build: .
    domain: my-app.mywildcarddomain.com
    port: 3000
    certificate:
      id: cert-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Conclusion

The new support for wildcard certificate reuse in Convox offers a powerful way to simplify SSL management and enhance security across your applications. By generating a single wildcard certificate and reusing it across multiple apps, you can reduce administrative overhead, avoid rate limits, and maintain consistent SSL coverage. Update your Convox environment today and start taking advantage of this feature to streamline your SSL management and improve your application's security posture.