Let's Encrypt at Scale

https://engineering.autotrader.co.uk/2018/09/04/letsencrypt-at-scale.html

by yarapavan • 8 years ago

111 15 8 years ago

engineering.autotrader.co.uk

yarapavan• 8 years ago

Etsy solution, which inspired this post -> https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...

tonyedgecombe• 8 years ago

I wonder why auto trader needs 3,000 domains, is this some kind of SEO tactic?

mtlogstdo• 8 years ago

They explain that in the article (the second sentence) - as well as the regular autotrader domains, they host sites for specific dealerships too, which are presumably just a rebadged version of their main site.

oneil• 8 years ago

Almost. The dealer websites are templated CMS's which allow dealerships to add and manage stock whilst seeing the current price around the local area for the specific vehicle that is being listed (based on condition etc). These sites and the stock are then entered into the main database which is indexed and presented to users via the search. This has changed and improved since. NB: I used to work for Autotrader back in 2011 before they moved to their current home.

ABS2• 8 years ago

from the very first paragraph:

"we offer a product that allows customers to host a private website using this stock, under their own domain. We wanted to provide HTTPS support to all of these websites."

majewsky• 8 years ago

Mobile-friendly version of this quote:

we offer a product that allows customers to host a private website using this stock, under their own domain. We wanted to provide HTTPS support to all of these websites.

Please do not use codeblocks for quotes. Just put a > in front of each paragraph.

cm2187• 8 years ago

Why don't they use DNS validation, it would seem to be easier. You can run the certificate renewal process independently from your web stack and just need to deploy the certificate at the end.

[edit]: Actually stupid question, these websites are for domains they don't control.

CamTin• 8 years ago

Another thing to think about with LE at scale, especially if you plan to renew your certs around the same time (rather than staggering them), is to make sure you don't run into rate-limiting problems. In fact, if you have a REALLY major deployment (probably more than the 3,000 domains discussed here) you should work directly with the LE team to make sure that their infra is ready for you and to work out a reasonable rate of API usage between you. I know this was the experience of at least one major web hosting provider when they began offering automated LE certs for customer sites and the LE team was very accommodating.

simplyinfinity• 8 years ago

just an FYI for people that host other people's domains dynamically, there is this Openresty ( nginx + lua + other goodies) module that does this automatically, and you can write a custom allow function to fetch "allowed" domains from Redis storage + store the certs in redis (for when you have multiple openresty instances) : https://github.com/GUI/lua-resty-auto-ssl

bacheson1293• 8 years ago

I was going to mention this...I've been using this setup for over a year with 6,000 domains...me thinks someone at autotrader needs to get better at Google :<

nodesocket• 8 years ago

Also, using Caddy webserver in front should work. Caddy has auto-lets encrypt and a "on-demand" feature to dynamically add and verify https for domains[1].

[1] https://caddyserver.com/docs/automatic-https#on-demand

subway• 8 years ago

This is currently how Help Scout deploys TLS certificates for Docs sites with custom domains: https://www.helpscout.net/knowledge-base/

I think we're in the ball park of 5000 domains right now.

beepboopah• 8 years ago

Also vetting this, I have a similar setup and I find it wonderful

moreentropy• 8 years ago

I hope they donate to Let's Encrypt.

Let's Encrypt at Scale

Related Stories