I received a notification for a Let’s Encrypt issued certificate for my domain name ( murdoch.is ), but I’m not sure why this has been issued. Is there any way to find out more information about what has happened?

Well… Someone either (momentarily) uploaded a file to http://murdoch.is/.well-known/acme-challenge/, or put a certificate on https://murdoch.is/, or created a TXT record at _acme-challenge.murdoch.is. Or compromised BGP, DNS or (goddess forbid) Let’s Encrypt to make it seem like they did. I take it…

Maybe FastMail is rolling out automatic Let’s Encrypt integration for their customers?

Thanks. I have asked Fastmail on Twitter but Australia is asleep at the moment. It would be great if they rolled out Let’s Encrypt integration, but a bit naughty to do it without asking first. I don’t think it was me, and can’t see anything in the 1984.is DNS control panel or Fastmail settings that…

Certificate is now revoked (validated through DNS). Thanks for having clear instructions here! I’m now suspecting it is Fastmail doing something funny. I have set up my Fastmail account to re-direct murdoch.is to another URL via HTTP 302, which seems to work fine $ wget -S -O /dev/null http://murd…

[image] sjmurdoch: Thanks. I have asked Fastmail on Twitter but Australia is asleep at the moment. It would be great if they rolled out Let’s Encrypt integration, but a bit naughty to do it without asking first. From our side there is nothing to indicate this was an unauthorized domain valida…

[image] sjmurdoch: However, if I request the ACME directory, I don’t get the re-direct. Maybe they are injecting their verification credentials here? Good catch. :slightly_smiling_face: That's quite likely. They must have had some reason to special case that directory, after all.

Did you know there’s a second certificate? 15:05 UTC https://crt.sh/?id=283182967&opt=ocsp (revoked) 17:52 UTC https://crt.sh/?id=283267218&opt=ocsp (not revoked) Did you create that certificate while revoking, or did FastMail get a second one?

@mnordhoff Yes, the second certificate is mine, which is created as a side-effect of the instructions on how to revoke a certificate . $ sudo openssl x509 -fingerprint -sha256 -inform pem -in /etc/letsencrypt/live/murdoch.is/cert.pem -noout SHA256 Fingerprint=17:AA:A9:1A:EF:19:EB:2D:88:05:22:D8:C6:B…

Thanks @cpu , it looks indeed like Fastmail have (inadvisedly, in my opinion) requested a Let’s Encrypt certificate without informing the owner in advance. I’m pleased that they are now offering HTTPS, but going about it this way has caused unnecessary confusion. I didn’t want to be getting certifica…

I totally understand. I would feel similar in your situation. I’m hopeful that this feedback will be heard by FastMail and used to avoid this sort of confusion in the future so we can get back to being happy about more domains getting HTTPS (and our Christmas shopping) :slight_smile:

Unexpected certificate for my domain

Help

schoen December 21, 2017, 1:24am 13

When you've done that, you might also want to list FastMail on

Topic		Replies	Views
A lot of certificates issued with my current email Help	2	502	May 14, 2020
Unknown certificate issued for my domain Help	8	2871	February 5, 2022
Edge Certificate issued without my Authorization Help	6	677	November 1, 2023
Misused certificates Issuance Policy	47	13507	September 7, 2023
Find out how has been done Issuance Tech	11	1299	September 20, 2019

Unexpected certificate for my domain

Related topics