Issue with TLS-ALPN-01 Validation Method
community.letsencrypt.org
Issue with TLS-ALPN-01 Validation Method
1–10 of 92 posts
Re: Issue with TLS-ALPN-01 Validation Method
#2My traefik setup is affected, should not be to difficult to refresh. It's automated anyway
Re: Issue with TLS-ALPN-01 Validation Method
#3My traefik setup is affected, should not be to difficult to refresh. It's automated anyway
It may not refresh automatically before they revoke. I had luck manually renewing which is largely automated but not entirely.
Re: Issue with TLS-ALPN-01 Validation Method
#4Wonder how many ACME deployments check for revocation, rather than just being on an infrequent cron job? What proportion of affected certificates will be automatically renewed with no effort?
Looking at a few docs, probably not many. In any case there isn't (?) an in-band way to tell the clients that the cert is going to be revoked before it is revoked, so there would be some disruption.
Re: Issue with TLS-ALPN-01 Validation Method
#5Wonder how many ACME deployments check for revocation, rather than just being on an infrequent cron job? What proportion of affected certificates will be automatically renewed with no effort? Looking at a few docs, probably not many. In any case there isn't (?) an in-band way to tell the clients that the cert is going to be revoked before it is revoked, so there would be some disruption.
There's a plan to make this information available to clients in the future: https://datatracker.ietf.org/doc/draft-aaron-acme-ari/
Re: Issue with TLS-ALPN-01 Validation Method
#6Wonder how many ACME deployments check for revocation, rather than just being on an infrequent cron job? What proportion of affected certificates will be automatically renewed with no effort? Looking at a few docs, probably not many. In any case there isn't (?) an in-band way to tell the clients that the cert is going to be revoked before it is revoked, so there would be some disruption.
Yeah, further, I doubt many certificates were issued from an account key belonging to a email address that people monitor often, if not at all.
Re: Issue with TLS-ALPN-01 Validation Method
#7This is the second security issue with a TLS-based challenge [1]. This was a good reminder to switch to the HTTP challenge for the one remaining server I had that was affected.
[1] https://letsencrypt.org/docs/challenge-types/#tls-sni-01
Re: Issue with TLS-ALPN-01 Validation Method
#8My traefik setup is affected, should not be to difficult to refresh. It's automated anyway
Same here. Fixed by deleting the traefik pods. The underlying Deployment regenerated them and a new cert was obtained.
Re: Issue with TLS-ALPN-01 Validation Method
#9No action necessary for Caddy: https://twitter.com/caddyserver/status/1486226944597233664
Re: Issue with TLS-ALPN-01 Validation Method
#10Wonder how many ACME deployments check for revocation, rather than just being on an infrequent cron job? What proportion of affected certificates will be automatically renewed with no effort? Looking at a few docs, probably not many. In any case there isn't (?) an in-band way to tell the clients that the cert is going to be revoked before it is revoked, so there would be some disruption.
WebPKI certificate revocation doesn't work anyways. It fails in exactly the case where TLS is needed: MITM.
All certificate revocation-checking schemes "fail open" and proceed happily on their way if the MITM blocks their communications with the revocation lists.
If you somehow don't have to worry about MITM you don't need anything remotely close to the complexity of TLS.
Certificate revocation is mostly security theater.