CT Precertificate Poison: critical
pocki80 opened this issue · comments
Since I updated the Agreement-Link in April 2018, renewal of existing certificates worked again, but each renewal shows up twice in the list of https://crt.sh/
First (bad?): https://crt.sh/?id=477428755
Second (good): https://crt.sh/?id=477429670
The first Cert has the following details (only the part that differs from the second cert):
CT Precertificate Poison: critical
0000 - 05 .
0002 - <SPACES/NULS>
The second Cert is issues "in the same second" and seems fine.
Any reason/idea why acme-tiny.sh results in issuing TWO but ONE cert?
BR
That has nothing to do with acme-tiny, but with Let's Encrypt and Certificate Transparency. The first entry is the precertificate, which is logged to obtain the SCTs (Signed Certificate Timestamps) from the CT logs. This certificate is poisoned (with the critical extension) so that it cannot be used. The second certificate then has these SCTs embedded and is the final certificate issued to you. Without the SCTs (for which the precertificate is needed), you would not be able to use the new certificates with Chrome any more (and in the future, also with other browsers).
Thank you for this explanation.
Do you now what that means to the cert creation limits and renewal limits? I cannot find any info for that on https://letsencrypt.org/docs/rate-limits/
It doesn't have any impact on the limits because it's the same 'certificate', Let's Encrypt are simply logging the pre-certificate which is your certificate before being signed.
Thx!