Our company sets up and maintains many WordPress networks, some of them approach 100 websites.
We developped a wp-cli script using let's encrypt that generates a SAN SSL certificate containing all domains of the WordPress network, and we set up this SAN certificate in the server block of our nginx configuration using
ssl_certificate so that all websites can use HTTPS.
Currently we have a single nginx vhost to handle the whole network, and this is quite practical so we don't have to create a new vhost each time we create a website.
The problem is Let's Encrypt limits SAN certificates to 100 domains so we soon won't be able to cover all websites.
The nginx documentation states that recent versions of nginx might in some case accept multiple ssl_certificate entries, but this seems to apply for certificates with different formats (RSA, SDA, etc.)
Here are my questions :
- If I split my SAN into blocks of 100, will I be able to use multiple ssl_certificate entries in my single nginx vhost ? Do I have to upgrade to nginx 1.11 for that ? or else
- Is there a simple solution to configure a limited number of vhosts (if possible not one per website) and share domains with a limited number of SAN certificates - if possible using only one IP address/cname ?
We could end up creating one vhost and one SSL certificate per website, and point all websites to the same document root, but we have a complex nginx setup (ssl, memcached, redirects, etc.) and we would like to minimize the website creation process as much as possible, so this would be the last (and most work needed) solution.