4 ms·
Thankfully it's fairly painless to see if you're affected: curl -XPOST -d 'fqdn=example.com' https://unboundtest.com/caaproblem/checkhost Replace example.
by shakna 7y ago
Thankfully it's fairly painless to see if you're affected:
curl -XPOST -d 'fqdn=example.com' https://unboundtest.com/caaproblem/checkhost
Replace example.com with your Fully Qualified Domain.
- MrStonedOne 7y agoThat can only test port 443, and not say, sstp on port 8384, or soap/https on port 3443 or other rando ports for various internal https layered applications
- deleted 7y ago[deleted]
- rswail 7y agoIt can only test hosts that it has access to. Otherwise you can download the file and check your serial number against the list.
- zimpenfish 7y agoIt can't test hosts that aren't on 443 though, regardless of access to the relevant port, e.g. (obvs. elided mydomain here.) $ curl -XPOST -d 'fqdn=pop3.mydomain:995' https://unboundtest.com/caaproblem/checkhost invalid name pop3.mydomain:995 404 page not found $ openssl s_client -connect pop3.mydomain:995 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d : Serial Number 0325f31485b9c0f393e27b00e4678e881e3c
- Ayesh 7y agoAll my recent certificates are affected. I think it is the same case for the majority of us.
- vesinisa 7y agoI use DNS validation to obtain one certificate with both domain.tld and *.domain.tld wildcard. My certificates seem not to be affected. My certs last auto-renewed on 2020-02-20.
- deleted 7y ago[deleted]
- tialaramex 7y agoThe most likely cause will be that you issued similar certificates a few days (more than eight hours) earlier with the same Let's Encrypt account. Suppose on Wednesday you get a cert for example.com and www.example.com, and then on Thursday you realise you also need images.example.com - you use the same ACME account (if you run Certbot this will happen by default if you use the same machine and user account, it silently makes you a free account if you don't have one already) and so Let's Encrypt can see that this account showed proof-of-control for two of these names on Wednesday, so only fresh proof-of-control of images.example.com is needed. Unfortunately this bug means Let's Encrypt forgot to re-check CAA for the old names, and so there's a risk they technically were no longer authorised to issue for these names and shouldn't have given you the Thursday certificate. Rather than try to argue about whether it's appropriate to disregard this check, Let's Encrypt decided to revoke all ~3 million affected certificates. That's maybe 2-3 days worth of normal issuance in the last 90 days, so lots but hardly "the majority".