[kuschku]

That is not a solution for everyone, as they offer no wildcart certificates yet. Also no EV auth.

At the current moment, it is questionable why some CAs – TURKTRUST comes to mind – are considered trustworthy, when they are barely more trustworthy than your random street dealer.

[mikeash]

Are wildcard certs still necessary if you can get a cert issued automatically with no delay?

[ytjohn]

Probably not for most use cases, but definitely if you have a dynamic host-based addressing scheme. In fact, my company uses a wildcard for an S3 compatible object storage service we've built in house.

A wildcard cert for example.com covers any <bucketname>.example.com our users create. Going round trip on requesting and issuing certs for each bucket would add significant delays.

[mikeash]

Makes sense. I can't quite figure out Let's Encrypt's (what an odd construction) policy on ultimately supporting wildcard certificates, but it sounds like they're generally opposed but not completely decided. Maybe they'll end up supporting it eventually.