lecaa

Check for Let's Encrypt CAA issue

usage

Prepare list of serials:

./prepare-lecaa

(This will download a list of affected certificates, extract the serial numbers and sort them.)

Run:

./lecaa [host]

It will output affected hosts and be silent for unaffected hosts.

This can be used in combination with GNU parallel to check a large number of hosts:

parallel -a [file_with_list_of_hosts] -j 30 --timeout 10 ./lecaa

You can use following alternative on macOS without GNU parallel due to possible moreutils package conflicts:

# requirements for following command: brew install findutils
gxargs -l ./lecaa < [file_with_list_of_hosts]

background

Let's Encrypt announced a bug in their system's CAA checks, which forced them to revoke 3 million certificates on very short notice.

This script allows you to efficiently check affected hosts.

who

Written by Hanno Bck, https://hboeck.de/

Related Projects

ssl-cert-check

Check expiry dates of local and remote SSL certificates

20 Aug 2014 29

Magisk-Revoke-China-Certs

Revoke risky Chinese certificates in case of potential security and censorship problem

30 Oct 2019 19

ctgrab

27 Jul 2017 25

testssl.sh

Testing TLS/SSL encryption anywhere on any port

01 Jul 2014 7,647

check_ssl_cert

A shell script (that can be used as a Nagios/Icinga plugin) to check an SSL/TLS connection.

20 Oct 2015 363

ed25519hetzner

Script to scan OpenSSH host key and known_hosts files for shared keys from server hoster Hetzner

31 Dec 2015 19

generate-ssl-certs-for-local-development

A bash script for generating trusted self-signed SSL certs for local development on your Mac

25 Oct 2018 1,362

RegionRestrictionCheck

A bash script to check the status of your IP on various geo-restricted services.

03 Jun 2021 3,999

letsencrypt-lighttpd

Renew your let's encrypt certificates monthly, using lighttpd as webserver.

15 Jan 2016 66

tlshelpers

A collection of shell scripts that help handling X.509 certificate and TLS issues

20 Jul 2017 126

badocspcert

Check for certs affected by July 2020 OCSP intermediate incident

07 Jul 2020 14

tls-scripts

scripts to help tls etc

18 Feb 2021 7

pki

Certificate Authority management suite

20 Jul 2014 26