Is it possible to gain information about the entity trying to request a certificate for a domain from the HTTP request on the well-known URI?
On my server logs I see Let’s Encrypt HTTP validation requests as shown below and I would like to know who is doing them.
cPanel will automatically perform local DCV validation to see if it is able to issue a certificate. These requests are not coming from the CA, they are just preflight requests by cPanel to see whether it might be possible to pass domain validation.
I just tried to connect to the listed IP address over port 2083 to identify it as a cPanel server. I already knew that cPanel does preflights in this way and just used that to confirm my theory.
If the IP address instead pointed to Comodo’s servers, then the explanation would have been something else.
Now to make this question useful, if it actually was a request from letsencrypt/comdo was there anything we could understand from the “29432C7C737A4B77CCA80275CABF5CC7.txt” part?
If I understand correctly, in the HTTP validation method, Let’s Encrypt checks for a unique random URL. Now the questions is, do they keep a publicly available log book that corresponds each generated URL to the requester?
I understood that the log entries I provided are not from Let’s Encrypt but Let’s Encrypt does access URLs of the form /.well-known/acme-challenge/TOKEN.txt doesn’t it?
I wanted to know if I can figure out the entity making the request to Let’s Encrypt by knowing the token.
I wanted to know that because I wanted to make sure no malicious person is trying to get a certificate for my domain.
More or less. Let's Encrypt URLs don't end in .txt.
Under similar circumstances, Let's Encrypt would be able to determine what's going on from their private logs. I'm not sure how much they could tell you about it, due to privacy concerns.
But Let's Encrypt isn't involved in this situation. The traffic seems to be coming from a cPanel installation using the AutoSSL feature configured to try to get a certificate from Sectigo (formerly known as Comodo). Not Let's Encrypt.
I don't know how cPanel AutoSSL works. cPanel or Sectigo might have logs, or the pre-validation check might happen before the cPanel installation actually makes any requests to any cPanel or Sectigo central servers.
You do have one lead -- the cPanel installation's IP address.
Maybe. It's more likely to be an accident than malicious. It could be a web hosting company you previously used, or someone who previously owned your domain used, or maybe someone misspelled their own domain as yours. And in any case validation shouldn't succeed.
