letsencrypt / letsencrypt/boulder
Have cert-checker look for issuance under recently-removed gTLDs
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Add to cert-checker a codepath (probably separate from it's current main codepath, but hopefully in the same binary for ease of deployment and monitoring) which does the following:
- Looks up a recent version of the ICANN gTLD JSON (probably just a file on disk that SRE processes are responsible for updating)
- Looks for any recently-removed gTLDs (if it runs every 24 hours, maybe it looks for one removed in the last 7 days?)
- Queries the issuedNames table for any certs issued under those names in the last 90 days
- Fires an alert (via a metric? via an error log line?) indicating that those certificates need to be revoked
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the existing cert-checker entry point and the issuedNames table, then review how the ICANN gTLD JSON can be supplied and refreshed. The work is done when recently removed gTLDs are checked for certificates issued in the last 90 days and the result produces an actionable revocation alert.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100