Verifique se o seu domínio foi afetado pelo erro de verificação de CAA do Lets Encrypt

Este breve guia – publicado por Mobile Linux Today  – explica como verificar se o seu domínio é afetado pelo bug de verificação de Lets encrypt CAA no Linux.

Let’s Encrypt is a non-profit Certificate Authority ( shortly CA) runby ISRG (Internet Security Research Group). They provide SSL/TLS certificates to enable https on millions of websites’ domain for free! Unfortunately, there is bug, known as CAA rechecking bug, in their CAA code.

Autorização da Autoridade Certificadora CAA reforça a cadeia de confiança da internet mundial

Milhões de sites tiveram problemas com o Certificado SSL gratuito

Bug no código da autoridade de certificação Let’s Encrypt [URGENTE !!!]

Let’s Encrypt CAA Rechecking Bug

According to the Let’s Encrypt announcement, when a certificate request contained N domain names that needed CAA rechecking, Boulder (the CA software) would pick one domain name and check it N times. What this means in practice is that if a subscriber validated a domain name at time X, and the CAA records for that domain at time X allowed Let’s Encrypt issuance, that subscriber would be able to issue a certificate containing that domain name until X+30 days, even if someone later installed CAA records on that domain name that prohibit issuance by Let’s Encrypt.

This bug is confirmed by the Let’s Encrypt team on February 29th, 2020. Let us see how to check if a website’s domain is affected by Letsencrypt CAA Rechecking Bug.

How To Check If Your Domain Is Affected By Let’s Encrypt CAA Rechecking Bug

To check if your domain has affected with CAA rechecking bug from any Unix-like systems, run:

$ curl -XPOST -d 'fqdn=www.example.com' https://unboundtest.com/caaproblem/checkhost

Replace www.example.com with your own domain name.

If you see an output like below, it means your domain is not affected!

The certificate currently available on www.example.com is OK. It is not one of the certificates affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0fd078dd48f1a2bd4d0f2ba96b6038fe0000

If your domain is affected, the message would be like:

The certificate currently available on www.example.com needs renewal because it is affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0fd078dd48f1a2bd4d0f2ba96b6038fe0000. See your ACME client documentation for instructions on how to renew a certificate.

Alternatively, you can use the following online tool to check if your domain is affected from a Windows system or mobile devices.

• https://checkhost.unboundtest.com/

Or, manually check your certificate serial number is present in the list of affected certs at the following link.

• Download affected certificate serials

$ wget https://d4twhgtvn0ff5.cloudfront.net/caa-rechecking-incident-affected-serials.txt.gz

Next find your certificate’s serial number:

$ openssl s_client -connect example.com:443 -showcerts -servername example.com </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d :

Replace example.com with your domain name.

Sample output:

Serial Number
0fd078dd48f1a2bd4d0f2ba96b6038fe0000

Now check the serial is present in the downloaded file:

$ zgrep '0fd078dd48f1a2bd4d0f2ba96b6038fe0000' caa-rechecking-incident-affected-serials.txt.gz

You can also check if your domain entry is present like below.

$ zgrep 'www.example.com' caa-rechecking-incident-affected-serials.txt.gz

If you see nothing, you are good to go! Your domain is not affected.

If you see the one or more domain names and certificate serials in the output, you MUST RENEW ASAP.

How many certificates are affected?

As stated in the Let’s Encrypt support forum, 2.6%, i.e. 3,048,289 currently-valid certificates are affected, out of ~116 million overall active Let’s Encrypt certificates. Let’s Encrypt has planned to revoke the certificates that were affected by this bug at 2020-03-04 20:00 UTC (3:00pm US EST). The affected subscribers have already been notified by Email. If your domain is affected, you would have probably received an Email with subject line – ACTION REQUIRED: Renew these Let’s Encrypt certificates by March 4. If you’ve received this mail, please renew the certificates ASAP.

Renew affected certificates

If your domain is affected by the CAA rechecking bug, you must renew it. Otherwise, your website visitors will see security warnings until you renew the certificate.

If you are using Certbot, the command to renew is:

certbot renew --force-renewal

If you can’t fix this issue on your own, reach out the Let’s Encrypt support forum or ask help from your hosting provider to fix this issue as soon as possible.

Update:

Let’s Encrypt postpones the certificate revocation. More details in the following link.

https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591/3

Fonte: mobile.linuxtoday

Bug no código da autoridade de certificação Let’s Encrypt [URGENTE !!!]

Milhões de sites tiveram problemas com o Certificado SSL gratuito