News for hackers. Stuff that matters.

A comment on W3.org Cert Expired. Parent comment

Re:W3.org Cert Expired by raggi on Tuesday June 01, 2021 @11:17PM (#27364423)
Interestingly, it also doesn't allow the CA that it's serving, at least per the CAA records:

  w3.org.                 3599 IN SOA ns1.w3.org. hostmaster.w3.org. (
                                  2021060201 ; serial
                                  28800      ; refresh (8 hours)
                                  3600       ; retry (1 hour)
                                  604800     ; expire (1 week)
                                  1800       ; minimum (30 minutes)
                                  )
  w3.org.                 3599 IN CAA 0 issuewild "sectigo.com"
  w3.org.                 3599 IN CAA 0 iodef "mailto:[email protected]"
  w3.org.                 3599 IN CAA 0 issue "amazon.com"
  w3.org.                 3599 IN CAA 0 issue "sectigo.com"
  w3.org.                 3599 IN CAA 0 issue "letsencrypt.org"
It does look like the records were updated recently.

The spf records are also interesting, but I know nothing about their mail setup.

A new Gandi cert was just issued: https://crt.sh/?id=4630660228 Perhaps it just needs a kick, or it'll be fixed soon.

[ Parent | on HN ]
Re:W3.org Cert Expired by bawolff on Tuesday June 01, 2021 @11:25PM (#27364478)
CAA only applies at time of issue. Its totally valid for your CAA records to not match the cert you are using, as long as CAA was ok at issue time.
[ Parent | on HN ]
Re:W3.org Cert Expired by raggi on Tuesday June 01, 2021 @11:26PM (#27364487)
Which it appears that it was not, at the time that cert was issued!

I have no idea if CAB have made CAA a requirement, but I presume not.

[ Parent | on HN ]
Re:W3.org Cert Expired by bawolff on Tuesday June 01, 2021 @11:31PM (#27364526)
It has been since 2017 afaik https://archive.cabforum.org/pipermail/public/2017-March/009...
[ Parent | on HN ]
Re:W3.org Cert Expired by raggi on Tuesday June 01, 2021 @11:46PM (#27364597)
Oh, self-correction, Gandi is a Sectico delegate.
[ Parent | on HN ]