4 ms·
Do you have a blog post or writeup on how you discovered that? Thanks!
by rob-olmos 3y ago
Do you have a blog post or writeup on how you discovered that? Thanks!
- agwa 3y agoThis all happened less than 2 hours ago, but a quick summary is that my Certificate Transparency monitor, Cert Spotter (https://sslmate.com/certspotter https://sslmate.com/certspotter) performs various sanity checks on every certificate that it observes. At 15:41 UTC today, I started getting alerts that certificates from Let's Encrypt were failing one particular check. I quickly emailed Let's Encrypt's problem reporting address, and Let's Encrypt promptly suspended issuance so they could investigate. I've lost count of how many CAs I've detected having this particular problem, so perhaps it is time to blog about it (https://www.agwa.name/blog https://www.agwa.name/blog if you're interested).
- conroydave 3y agothis is why i will always love hacker news. thank you
- deleted 3y ago[deleted]
- mardifoufs 3y agoThat's awesome!! I wonder if let's encrypt runs sanity checks before/after issuing certs too?
- agwa 3y agoThey "lint" certificates before issuance, as do most CAs. However, I don't think any linters check for this problem, as it requires access to more than just the certificate (the linter would need access to either the precertificate or a database of Certificate Transparency log keys).
- pabs3 3y agoAre these linters open source?
- agwa 3y agoYup, the two most popular are: https://github.com/zmap/zlint https://github.com/zmap/zlint https://github.com/certlint/certlint https://github.com/certlint/certlint They each have their strengths and weaknesses, so CAs are advised to use both.
- mcpherrinm 3y agoWe will add a lint to Boulder for precertificate and certificate correspondence to ensure this class of problem never happens again. It would be nice to add this to Zlint, but we'd need a new interface that could be given both a precertificate and certificate to co-lint. Other than this one correspondence check, I'm not sure if there's any other lints that would fit that pattern.
- dopamean 3y agoThis iso so awesome. Thank you for sharing. I hope you do write about that problem. I'd love to learn something new.
- toomuchtodo 3y agoCurious people contributing to the ongoing functioning of critical systems at scale. Thank you for your effort! https://xkcd.com/2347/ https://xkcd.com/2347/
- mholt 3y agoI would love to read a blog of yours with more information.
- danShumway 3y agoI will also throw out a quick vote that I'd be interested in reading a blog post about it.