3 ms·

I ran into a similarly weird issue with CloudFlare. This post made me check my domain that I recently bought. I bought the domain passkey.exchange through Clou

I ran into a similarly weird issue with CloudFlare. This post made me check my domain that I recently bought. I bought the domain passkey.exchange through Cloudflare on 12 April and I didn't set up ANYTHING on it. No DNS records. Nothing. I didn't touch it since Yet. Exactly at the purchase time. 3 certificates where added to the certificate transparency log: 2 from LetsEncrypt and one from Google. How? https://crt.sh/?q=passkey.exchange https://crt.sh/?q=passkey.exchange The only explanation that i have is that Cloudflare is doing some kind of integration testing after you buy a domain from them on Google Cloud and LetsEncrypt before giving you the domain. But that means they have some private key somewhere for 90 days. Across two different CAs.. Or I have really bad memory. Set up some Infrastructure on Google Cloud and then deprovisioned it again and removed all DNS records. Or I was hacked. It's really strange. Edit: digging further it must've been Cloudflare. The google cert has Not Before: Apr 12 22:01:51 2024 GMT My invoice is dated 22:49 UTC. One hour after the cert was issued?

beeboobaa3 2y ago
Yes, Cloudflare controls your DNS and they advertise setting up HTTPS for you. If they'd wait until you added a DNS record that's routed through them, which they are by default, then that'd be poor user experience. The timestamp difference is probably just Google backdating the certificate by an hour or 30 minutes to deal with clients whose clocks lag behind.
- 8organicbits 2y ago
  What method do they use to get the certificate? I'd guess ACME DNS-01 challenge, but that means they are setting DNS records you didn't explicitly ask for. Getting a TLS certificate is pretty quick, I'd probably prefer to wait 10 seconds versus having unexpected DNS records. (edit: although I'm a DevOps engineer and I wrote my own subdomain registration service, so my preference will certainly not match others).
  - fastball 2y ago
    Many (most?) registrars add DNS you didn't explicitly ask for, like an A record on the root that says "this domain was purchased from Namecheap" or whatever. Do you know of a registrar that doesn't do that?
    - rgrmrts 2y ago
      DNSimple doesn’t do that (https://dnsimple.com/ https://dnsimple.com/)
      - deleted 2y ago
        [deleted]
    - dmd 2y ago
      I've never used a registrar that does do that.
      - beeboobaa3 2y ago
        How would you know? It's not like those records are displayed in their configuration panel and the only way to request TXT records for e.g. a subdomain is to know that subdomain even exists ahead of time.
        8organicbits 2y ago
        If we're still talking about TLS certs, the transparency log has that info (mentioned in the article). I also assume this thread is talking about the domain and any subdomains you're actually using. What would the reason be of setting TXT records for unguessable subdomains?
        beeboobaa3 2y ago
        My comment was regarding DNS records, since this subthread switched to talking about DNS 2 comments up: > Many (most?) registrars add DNS you didn't explicitly ask for This relates to TLS since DNS records can be used to request a TLS certificate, but yes, those show in the certificate transparency log, so that you can check. But it won't tell you about other DNS records that may be used for various other purposes.

beeboobaa3 2y ago

Yes, Cloudflare controls your DNS and they advertise setting up HTTPS for you. If they'd wait until you added a DNS record that's routed through them, which they are by default, then that'd be poor user experience. The timestamp difference is probably just Google backdating the certificate by an hour or 30 minutes to deal with clients whose clocks lag behind.

8organicbits 2y ago
What method do they use to get the certificate? I'd guess ACME DNS-01 challenge, but that means they are setting DNS records you didn't explicitly ask for. Getting a TLS certificate is pretty quick, I'd probably prefer to wait 10 seconds versus having unexpected DNS records. (edit: although I'm a DevOps engineer and I wrote my own subdomain registration service, so my preference will certainly not match others).
- fastball 2y ago
  Many (most?) registrars add DNS you didn't explicitly ask for, like an A record on the root that says "this domain was purchased from Namecheap" or whatever. Do you know of a registrar that doesn't do that?
  - rgrmrts 2y ago
    DNSimple doesn’t do that (https://dnsimple.com/ https://dnsimple.com/)
    - deleted 2y ago
      [deleted]
  - dmd 2y ago
    I've never used a registrar that does do that.
    - beeboobaa3 2y ago
      How would you know? It's not like those records are displayed in their configuration panel and the only way to request TXT records for e.g. a subdomain is to know that subdomain even exists ahead of time.
      - 8organicbits 2y ago
        If we're still talking about TLS certs, the transparency log has that info (mentioned in the article). I also assume this thread is talking about the domain and any subdomains you're actually using. What would the reason be of setting TXT records for unguessable subdomains?
        beeboobaa3 2y ago
        My comment was regarding DNS records, since this subthread switched to talking about DNS 2 comments up: > Many (most?) registrars add DNS you didn't explicitly ask for This relates to TLS since DNS records can be used to request a TLS certificate, but yes, those show in the certificate transparency log, so that you can check. But it won't tell you about other DNS records that may be used for various other purposes.