3 ms·
Disclaimer: I’ve been an engineer on various CAs in the past. If you run into this issue, contact the CA directly and not Cloudflare. The CA is required to ha
by aaomidi 2y ago
Disclaimer: I’ve been an engineer on various CAs in the past.
If you run into this issue, contact the CA directly and not Cloudflare.
The CA is required to handle your request within 24 hours. If they do not, that is an incident for the CA.
- tgsovlerkhgsel 2y agoAnd Let's Encrypt actually provides an API for this: https://letsencrypt.org/docs/revoking/#using-a-different-authorized-account https://letsencrypt.org/docs/revoking/#using-a-different-aut... I don't think it makes a significant difference (I believe browsers don't implement revocation in any meaningful way), but the option exists.
- aaomidi 2y agoFirefox does do revocation.
- tgsovlerkhgsel 2y agoHuh, you're right - it also seems to be enabled by default. I tried with a clean profile and https://revoked.badssl.com/ https://revoked.badssl.com/ showed an error (Chrome loads the page).
- crcastle 2y agoiOS Safari also shows an error and refuses to load the page.
- vetrom 2y agoLots of browsers avoid it for reasons, but isn't this the whole point of the OCSP(https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Pr...) and OCSP stapling?
- tgsovlerkhgsel 2y agoYes, protocols for this exist... but as you said, browsers tend to avoid them. Edit: Firefox seems to check revocation by default. https://revoked.badssl.com/ https://revoked.badssl.com/ if you want to test.
- neurostimulant 2y agoThis requires the certificat's private key, right? Can you download the key for letsencrypt certificates generated by cloudflare?
- agwa 2y agoNo, if you can complete challenges for every DNS name in the certificate then the API lets you revoke it.
- tgsovlerkhgsel 2y agoNo, as the section I linked explains, you can also prove that you own the domain and then revoke the cert without having the private key. It's meant exactly for cases where some other party has obtained a cert for your domain for whatever reason (change of ownership, compromise, ...)
- 8organicbits 2y agoThis is a valid request, right? You'd claim that you've withdrawn permission from CF (not that the key was compromised). Looking at this RFC: https://datatracker.ietf.org/doc/html/rfc5280 https://datatracker.ietf.org/doc/html/rfc5280 And CF has no obligation to revoke the cert when it's no longer needed, nor to act as a free middleman between domain owner and CA.
- aaomidi 2y agoCF does “technically” have that obligation under many subscriber agreements. Cloudflare could make this much easier by revoking the cert when the customer moves away from them. They probably should do this.