Hi folks, I’ve been working on the wording for our second round of TLS-SNI deprecation emails, plus some of the underlying code. My current thinking is that it’s better / easier to include the affected IP addresses in the email rather than the domains. There are a lot of accounts that have a large …

After some more thinking and experimenting I think the way that makes sense to organize this information is that we’ll report one domain and one IP address per account. This limits the size and complexity, is consistent and easy to explain, and since most of the time one account is operated by one p…

[image] jsha: Our staging environment already has TLS-SNI-01 disabled, so if you’d like to test whether your system will work fine after the deprecation date, you can run against staging. I think it may be worth providing a link about the staging environment here. Staging Environment - Let's …

[image] bmw: I think it may be worth providing a link about the staging environment here. Staging Environment - Let's Encrypt works, but I kind of want to remove the suggestion to use --staging with Certbot in favor of --dry-run if we’re going to be including a link to this page in the email. …

[image] jsha: That’s a great idea. Can you send a PR at GitHub - letsencrypt/website: Let's Encrypt Website and Documentation ? [image] bmw: Don't tell people to use --staging. letsencrypt:master ← bmw:staging-to-dry-run …

I also wanted to add that I think this is a good idea: [image] jsha: killing the authz caching on staging for a few days could help? This is a cool idea! I think it’s doable; I’ll check with the team. I'm not sure how many people will have reusable staging authzs and how significant the i…

[image] jsha: Yep, we’ve disabled authz reuse in staging as of today . I'm not seeing it yet. I did a --dry-run on a certificate, and then I issued two staging certificates for a new hostname, and it still did normal authz reuse. E.g.: https://acme-staging-v02.api.letsencrypt.org/acme/order…

Hey @mnordhoff , [image] mnordhoff: I’m not seeing it yet. I did a --dry-run on a certificate, and then I issued two staging certificates for a new hostname, and it still did normal authz reuse. You're right. I saw your comment and double checked myself and saw the same results. I checked the…

[image] cpu: I checked the V1 API as well and it had the intended effect there. I filed a bug to fix the ACME v2 valid authz reuse: Quick update here: We deployed a fix outside of the usual cycle to make sure this was addressed. The staging environment is now properly not reusing valid author…

Candidate second email

Site Feedback

jsha January 23, 2019, 5:26am 19

Yep, we’ve disabled authz reuse in staging as of today.

Topic		Replies	Views
Received 2nd email but certbot test passed? Help	23	2624	February 13, 2019
ACME TLS-SNI-01 Email.. can we please include the domain Help	15	2509	January 28, 2019
Action is required to prevent your Let's Encrypt certificate renewals from breaking Help	22	3414	January 23, 2019
TLS-SNI-01 validation is reaching end-of-life Help	25	5278	February 6, 2019
"Your Let’s Encrypt client used ACME TLS-SNI-01..." Which one? Feature Requests	16	6908	January 21, 2019

Candidate second email

Related topics