Expiration notifications for domains I don't own

Help
1

My domain is:
www.xn–h9tq4m26w4jw.top
www.toppageagency.com

The above two domains appear to be hosted on a digitalocean ip I had last year. I’ve just started getting certificate expiring messages for them but they aren’t my domains and I’ve never requested certificates for them. I’m assuming the person getting the ip after me from digitalocean wouldn’t know the email address of the previous owner of that ip so it appears LE is automatically assigning my email address to domains from an ip address I’ve previously used. Is this how it works or is there something else going on here?

2

@lestaff, could there be any sort of bug that would account for this? It seems like a pretty mysterious problem to me.

3

Is it possible that what those domains have in common with yours isn't a DigitalOcean IP, but a current or past Plesk installation? It's a long shot, but that's a surprising issue that we've encountered before with expiration e-mails:

4

Hi James,

No, not in this case the machines would have been standard Ubuntu 18.04 images. Only thing on them would be nginx(possibly openresty).

5

This is quite bizarre, then. Expiration e-mails are tied to your ACME registration (account), never based on IP addresses or any kind of auto-discovery. Could you please post one of your own domains? We won’t be able to disclose account information, but that might help us look into the cause.

6

Hi James,

Thanks for jumping in to try and figure this out.

northandsouthnomads.com is mine. Do you need all the domains on that certificate or just the one?

7

If you indeed used that system to get any LE certs…
It sounds like the system was reused without a complete wipe (extremely bad practice).
[leaving some cert settings behind - like your email address]

8

Even if the VPS company has an extremely bad security problem and is unexpectedly failing to wipe disks

(even worse than that other incident)

it would be a large coincidence for a new VPS to get some of the same disk blocks and the same IP address as a previous one.

9

It would be much more likely if it was the exact same physical system [and drive and IP].
But who are we to know what they do or how they do it.

10

I’ve opened a support ticket with Digital Ocean to investigate but in a few years of using them and a few hundred servers created I’ve never gotten a server that wasn’t freshly imaged.

11

I’ve confirmed that this doesn’t look like a bug on our end. I’ll be very curious to hear what, if anything, you find out; please follow up if you can. Thanks for bringing this to our attention!

12

Hi James,

Thank you for your time looking into it. Digitalocean has said there is no way it could be on their side as all servers are given freshly wiped disks when imaged.

So unfortunately I don’t think this will be solved. Is it possible to see all the certificates linked to my email address somehow and invalidate/block the ones that aren’t mine?

13

This is very odd. Thanks for the update!

Unfortunately, we don’t have ways to unsubscribe from some expiration e-mails and not others, or to remove your e-mail address from an ACME account for which you don’t control the key. Unsubscribing from all expiration e-mails, or manually filtering ones that mention unwanted domains, may be your best bet.

I’m sorry about that, and thanks again for bringing this up. We try to keep these corner cases in mind for future improvements.

14

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.