Check for Let's Encrypt CAA issue
Prepare list of serials:
./prepare-lecaa
(This will download a list of affected certificates, extract the serial numbers and sort them.)
Run:
./lecaa [host]
It will output affected hosts and be silent for unaffected hosts.
This can be used in combination with GNU parallel to check a large number of hosts:
parallel -a [list_of_hosts] -j 30 --timeout 10 ./lecaa
Let's Encrypt announced a bug in their system's CAA checks, which forced them to revoke 3 million certificates on very short notice.
This script allows you to efficiently check affected hosts.
- https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864
- https://www.golem.de/news/tls-let-s-encrypt-muss-drei-millionen-zertifikate-zurueckziehen-2003-146999.html
Written by Hanno Böck, https://hboeck.de/