目前是 腾讯云、火山云、阿里云、华为云都有用到了这个 泛域名证书（CDN加速跟ELB业务）还有几台服务器，自动化太可怕了 目前还是选择手动，到期前批量替换一波
在捣鼓certd ;
基本ok 了;
你不上自动化也就能拖个两年左右了
caddy部署Let’s Encrypt野卡，无感知自动续期
DNS resolution is another issue, isn’t it?
ACME can solve the wildcard domain problem
38刀/年 ssls 这个证书网站
给你看看谷歌的证书
总结
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
58:6d:0e:73:1b:76:c3:2e:0a:2d:6e:41:85:fb:d3:48
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=US, O=Google Trust Services, CN=WE2
Validity
Not Before: Sep 8 08:35:04 2025 GMT
Not After : Dec 1 08:35:03 2025 GMT
Subject: CN=*.google.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:a5:1e:c4:6a:5a:58:3e:4d:cb:af:67:a8:8c:2b:
b9:a7:2f:f0:39:27:2d:d4:37:15:31:ec:88:23:a2:
d9:1d:9a:75:ee:33:bb:76:a6:89:63:78:2a:70:3e:
15:db:75:e2:d4:06:5b:f3:d4:f2:2b:87:97:61:0f:
5b:20:d4:4c:51
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
66:D7:3B:A8:EC:32:5D:FE:A2:16:A9:16:28:03:7E:26:34:92:AB:86
X509v3 Authority Key Identifier:
75:BE:C4:77:AE:89:F6:44:37:7D:CF:B1:68:1F:1D:1A:EB:DC:34:59
Authority Information Access:
OCSP - URI:http://o.pki.goog/we2
CA Issuers - URI:http://i.pki.goog/we2.crt
X509v3 Subject Alternative Name:
DNS:*.google.com, DNS:*.appengine.google.com, DNS:*.bdn.dev, DNS:*.origin-test.bdn.dev, DNS:*.cloud.google.com, DNS:*.crowdsource.google.com, DNS:*.datacompute.google.com, DNS:*.google.ca, DNS:*.google.cl, DNS:*.google.co.in, DNS:*.google.co.jp, DNS:*.google.co.uk, DNS:*.google.com.ar, DNS:*.google.com.au, DNS:*.google.com.br, DNS:*.google.com.co, DNS:*.google.com.mx, DNS:*.google.com.tr, DNS:*.google.com.vn, DNS:*.google.de, DNS:*.google.es, DNS:*.google.fr, DNS:*.google.hu, DNS:*.google.it, DNS:*.google.nl, DNS:*.google.pl, DNS:*.google.pt, DNS:*.googleapis.cn, DNS:*.googlevideo.com, DNS:*.gstatic.cn, DNS:*.gstatic-cn.com, DNS:googlecnapps.cn, DNS:*.googlecnapps.cn, DNS:googleapps-cn.com, DNS:*.googleapps-cn.com, DNS:gkecnapps.cn, DNS:*.gkecnapps.cn, DNS:googledownloads.cn, DNS:*.googledownloads.cn, DNS:recaptcha.net.cn, DNS:*.recaptcha.net.cn, DNS:recaptcha-cn.net, DNS:*.recaptcha-cn.net, DNS:widevine.cn, DNS:*.widevine.cn, DNS:ampproject.org.cn, DNS:*.ampproject.org.cn, DNS:ampproject.net.cn, DNS:*.ampproject.net.cn, DNS:google-analytics-cn.com, DNS:*.google-analytics-cn.com, DNS:googleadservices-cn.com, DNS:*.googleadservices-cn.com, DNS:googlevads-cn.com, DNS:*.googlevads-cn.com, DNS:googleapis-cn.com, DNS:*.googleapis-cn.com, DNS:googleoptimize-cn.com, DNS:*.googleoptimize-cn.com, DNS:doubleclick-cn.net, DNS:*.doubleclick-cn.net, DNS:*.fls.doubleclick-cn.net, DNS:*.g.doubleclick-cn.net, DNS:doubleclick.cn, DNS:*.doubleclick.cn, DNS:*.fls.doubleclick.cn, DNS:*.g.doubleclick.cn, DNS:dartsearch-cn.net, DNS:*.dartsearch-cn.net, DNS:googletraveladservices-cn.com, DNS:*.googletraveladservices-cn.com, DNS:googletagservices-cn.com, DNS:*.googletagservices-cn.com, DNS:googletagmanager-cn.com, DNS:*.googletagmanager-cn.com, DNS:googlesyndication-cn.com, DNS:*.googlesyndication-cn.com, DNS:*.safeframe.googlesyndication-cn.com, DNS:app-measurement-cn.com, DNS:*.app-measurement-cn.com, DNS:gvt1-cn.com, DNS:*.gvt1-cn.com, DNS:gvt2-cn.com, DNS:*.gvt2-cn.com, DNS:2mdn-cn.net, DNS:*.2mdn-cn.net, DNS:googleflights-cn.net, DNS:*.googleflights-cn.net, DNS:admob-cn.com, DNS:*.admob-cn.com, DNS:*.gemini.cloud.google.com, DNS:googlesandbox-cn.com, DNS:*.googlesandbox-cn.com, DNS:*.safenup.googlesandbox-cn.com, DNS:*.gstatic.com, DNS:*.metric.gstatic.com, DNS:*.gvt1.com, DNS:*.gcpcdn.gvt1.com, DNS:*.gvt2.com, DNS:*.gcp.gvt2.com, DNS:*.url.google.com, DNS:*.youtube-nocookie.com, DNS:*.ytimg.com, DNS:ai.android, DNS:android.com, DNS:*.android.com, DNS:*.flash.android.com, DNS:g.cn, DNS:*.g.cn, DNS:g.co, DNS:*.g.co, DNS:goo.gl, DNS:www.goo.gl, DNS:google-analytics.com, DNS:*.google-analytics.com, DNS:google.com, DNS:googlecommerce.com, DNS:*.googlecommerce.com, DNS:ggpht.cn, DNS:*.ggpht.cn, DNS:urchin.com, DNS:*.urchin.com, DNS:youtu.be, DNS:youtube.com, DNS:*.youtube.com, DNS:music.youtube.com, DNS:*.music.youtube.com, DNS:youtubeeducation.com, DNS:*.youtubeeducation.com, DNS:youtubekids.com, DNS:*.youtubekids.com, DNS:yt.be, DNS:*.yt.be, DNS:android.clients.google.com, DNS:*.android.google.cn, DNS:*.chrome.google.cn, DNS:*.developers.google.cn, DNS:*.aistudio.google.com
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://c.pki.goog/we2/yK5nPhtHKQs.crl
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 12:F1:4E:34:BD:53:72:4C:84:06:19:C3:8F:3F:7A:13:
F8:E7:B5:62:87:88:9C:6D:30:05:84:EB:E5:86:26:3A
Timestamp : Sep 8 09:35:11.007 2025 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:20:7C:66:D6:C5:BE:51:76:94:3E:5D:08:5A:
A4:A1:99:84:56:A8:4C:AF:74:AA:DE:BF:20:A8:FE:7C:
32:B6:C1:6D:02:21:00:B8:97:72:A2:F4:D7:3B:A8:E5:
C3:04:77:D4:83:2D:7E:9B:46:A4:39:C3:4A:59:B2:62:
9B:D9:37:5B:1F:A0:74
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 0D:E1:F2:30:2B:D3:0D:C1:40:62:12:09:EA:55:2E:FC:
47:74:7C:B1:D7:E9:30:EF:0E:42:1E:B4:7E:4E:AA:34
Timestamp : Sep 8 09:35:11.049 2025 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:44:02:20:30:E7:38:E2:5F:D1:FF:85:14:13:CB:7C:
74:36:4B:C8:53:01:AB:AF:63:D0:F0:81:24:CE:2F:23:
F3:93:62:5E:02:20:58:2C:52:EB:55:52:F7:40:35:61:
6C:8D:5E:D2:D4:2A:4B:24:BA:E9:3E:F9:3F:A2:A4:7A:
40:B6:AE:2A:C4:79
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
30:46:02:21:00:ba:21:c1:a0:68:03:d4:b6:1b:e3:e0:71:82:
10:f7:d9:c3:26:7b:25:f5:af:b4:85:1f:36:8a:1b:85:fd:cc:
27:02:21:00:dd:28:f5:37:b5:1c:63:05:6f:e0:39:6f:65:11:
3d:03:a0:c4:9d:69:1d:04:86:a7:78:f9:94:5f:52:bf:bf:5e
注意 X509v3 Subject Alternative Name 中子域名的数量
反正不是什么技术问题
商用还是买一个了。