Not able to use letsencrypt certificates for AWS Load Balancer Domain names due to length

[upgradingdave]

AWS provides convenience DNS names for load balancers.

However, if you try to configure letsencrypt to genererate certificates for these domain names, you will see an exception like this:

Message:               Failed to wait for order resource "tls-secret-ltx5k-1407422140" to become ready: order is in "errored" state: Failed to create Order: 400 urn:ietf:params:acme:error:rejectedIdentifier: NewOrder request did not include a SAN short enough to fit in CN

The default configuration for lets encrypt uses the DNS name for the Common Name (CN) in the certificate.

Apparently Letsencrypt limits the length of this CN.

So, the default letsencrypt configuration fails.

It should be possible to configure letsencrypt to use a SAN that is different than the Domain name. Need to research to find how to configure this inside Kubernetes environment.