- Joined
- Feb 27, 2003
- Messages
- 9,158
Hello,
You may or may not have received an email from [email protected] with the subject:
This is the related URL they've referenced describing the issue:
community.letsencrypt.org
We do have a solution already in play in CustomBuild rev 2430 on our mirrors, where you'd simply need to run:
and you'll see something like:
If you have any affected domains, they'll be logged in the check file:
and each renewed domain will be added to this .le_caa_fix log file as:
which is pushed to the task.queue for immediate renewal after resetting the domain.com.creation_time file to 1577994077, which is "61 days ago" so it should trigger the auto-renewal normally.
If the .le_caa_fix file is present, the check will not be run again. If you need it to run again, just delete the .le_caa_fix and re-run ./build versions.
Note, if you've got CustomBuild setup to update daily and send you a notice about new versions, the above will be covered within this, once you get the new script and the related calls are triggered. (If anyone wants to dig into the build script, the check is done in the doChecks() function call, which is called by various ./build <options>, including ./build versions.)
CustomBuild uses the provided curl request to the LE servers to confirm if a given domain is affected, so only affected domains will be renewed.
If you're only a User and your cert has issues from revocation, you can simply re-request it normally from your User Level, in case you get to it before your Admin or before CustomBuild does it for you.
John
You may or may not have received an email from [email protected] with the subject:
This is the related URL they've referenced describing the issue:
Revoking certain certificates on March 4
[Update 2020-03-05: The most up-to-date summary is at 2020.02.29 CAA Rechecking Bug] Due to the 2020.02.29 CAA Rechecking Bug, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information. This post and...
community.letsencrypt.org
We do have a solution already in play in CustomBuild rev 2430 on our mirrors, where you'd simply need to run:
Code:
cd /usr/local/directadmin/custombuild
./build update
./build versions
Code:
[root@server custombuild]# ./build versions
Checking Let's Encrypt certificates for renewal (to fix CAA bug)...
....
Code:
/usr/local/directadmin/custombuild/.le_caa_fix
Code:
Renewing domain.comIf the .le_caa_fix file is present, the check will not be run again. If you need it to run again, just delete the .le_caa_fix and re-run ./build versions.
Note, if you've got CustomBuild setup to update daily and send you a notice about new versions, the above will be covered within this, once you get the new script and the related calls are triggered. (If anyone wants to dig into the build script, the check is done in the doChecks() function call, which is called by various ./build <options>, including ./build versions.)
CustomBuild uses the provided curl request to the LE servers to confirm if a given domain is affected, so only affected domains will be renewed.
If you're only a User and your cert has issues from revocation, you can simply re-request it normally from your User Level, in case you get to it before your Admin or before CustomBuild does it for you.
John
