Production SSL/TLS Certificate Expired: Okutereeza HSTS Hard-Fail Okuvaako era Ka Tusibe CAA/Rate-Limit Blocks¶

Nga okufulumya SSL/TLS (HTTPS) satifikeeti eggwaako - ne bwe kiba nga sikonda emu eyiseeko yaayo notAfter UTC timestamp - buli browser ey'omulembe (Chrome, . Safari, . Firefox, . Edge), app ku ssimu (iOS App Transport Security, . Android Network Security Config), omuweereza w’omukutu (Stripe, . Shopify, . Twilio, . GitHub), era upstream API client amangu ago severs okuyungibwa ne NET::ERR_CERT_DATE_INVALID oba SSL_ERROR_RX_RECORD_TOO_LONG. Ekisinga obubi, singa domain yo esindika... Strict-Transport-Security (HSTS) omutwe oba nga ekuŋŋaanyiziddwa mu browser HSTS Preload List, Chrome ne Safari ziggyawo "Advanced -> Proceed to site (unsafe)" bypass button ddala, ekivaamu okuzikiza okulemererwa okuzibu ebitundu 100 ku 100 eri buli mukozesa mu nsi yonna. Ebiseera ebisinga, cronjob y’okuzza obuggya mu ngeri ey’obwengula (Certbot, . acme.sh, . Caddy, . cert-manager, oba AWS ACM) ebadde eremereddwa mu kasirise okumala ennaku 30 olw'okuziyiza DNS CAA likodi, DNSSEC eyamenyese DS record, omwalo oguziyiza firewall 80 (HTTP-01 okusoomoozebwa), oba omukutu gwa yintaneeti (nginx / . haproxy) eyazza obuggya fayiro ku disiki (fullchain.pem) naye teddamu kutikkako nkola zaayo ez’omukozi mu jjukira. Singa okuvaako kwo kwava ku kuwandiisa domain okuggwaako oba nameservers eziwambiddwa okusinga satifikeeti ya X.509 yennyini, kyusa mangu ku okuwamba amannya ga domain, DNS eggwaako, n'okutwala omukutu gwa yintaneeti; singa seva yo eba tetuukirirwa ddala oba evudde mu kifo kya disiki kale certbot tasobola kuwandiikira /etc/letsencrypt, laba server disk 100% ejjudde ate nga zero-space recovery oba ekizibu ky'okukyaza omukutu, okusenguka, n'okuzzaawo backup. Singa okuziba kuno okwa TLS kulemesa okupima essimu mu ddwaaliro, APIs z’okusindika mu bwangu, oba ebikozesebwa mu by’okwerinda by’olukale, kuba ku nnamba yo ey’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba weebuuze ku ndagiriro yaffe ey’ensi yonna eya ennamba z’amangu.

Kino kikole kati¶

1. Kebera mu sikonda 10 oba ddala satifikeeti eri ku disiki yazzibwa buggya dda, era web server yo oba load balancer yamala kulemererwa okuddamu okugitikka mu RAM:
2. Geraageranya socket ya TLS obulamu ku... .pem fayiro ku disiki kati:

   # 1. What the live server is serving over the network:
   echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -serial
   # 2. What is actually sitting on disk in /etc/letsencrypt/live/:
   sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -issuer -serial
   

3. Singa fayiro eri ku disiki eraga ebiseera eby'omu maaso ebituufu notAfter olunaku ate nga omwalo omulamu 443 eraga olunaku oluwedde: Kasitoma wo wa ACME (certbot / . acme.sh) yatuuka ku buwanguzi wiiki eziyise, naye nginx, . apache2, . haproxy, oba postfix teyaddamu kutikkibwangako, oba (haproxy / . vault) kyetaagisa fullchain.pem + privkey.pem eziyungiddwa mu kibinja kimu. Dduka sudo nginx -t && sudo systemctl reload nginx (oba sudo systemctl reload apache2 haproxy) era okuvaako kwo kujja kuggwa mu sikonda 2.
4. TODDUKA certbot renew --force-renewal enfunda n'enfunda mu loopu singa okuzza obuggya kulemererwa: Let's Encrypt essa mu nkola ekkomo erikakali ery'omuwendo erya satifikeeti 5 eziddirira buli nnaku 7 ne okukakasa 5 okulemererwa buli akawunti, buli linnya ly'omukozi, buli ssaawa. Okudduka --force-renewal emirundi etaano mu kusattira nga totereeza wansi nginx reload oba DNS/firewall bug ejja kusiba domain yo okuva mu kufulumya Let's Encrypt okumala ennaku 7.
5. Bw'okuba Let's Encrypt Rate Limit (429 Too Many Requests), kyusa kasitoma wo wa ACME okudda ku kitongole kya Satifikeeti eky’olukale eky’okubiri eky’obwereere (ZeroSSL, . Buypass Go SSL, oba Google Trust Services) oba okwongerako subdomain SAN ey'okusuula amangu ddala:
6. Buli kasitoma wa ACME (certbot, . acme.sh, . caddy, . cert-manager) asobola okusaba satifikeeti eyesigika ey’obwereere okuva mu CA ey’enjawulo mu sikonda 30 (--server https://acme.zerossl.com/v2/DV90 oba https://api.buypass.com/acme/directory), okuyita ddala ku kkomo ly'emiwendo gya Let's Encrypt.
7. Ekirala, ekkomo lya Let's Encrypt erya "satifikeeti 5 eziddirira buli nnaku 7" likola ku ekibinja kye kimu ddala eky'Amannya Amalala ag'Essomo (SANs). Okwongerako subdomain emu entuufu ey’enjawulo (-d example.com -d www.example.com -d tlsfix1.example.com) egifuula satifikeeti etali ya kuddiŋŋana era n’eyita ku kkomo ly’omuwendo gwa Satifikeeti ey’okuddiŋŋana amangu ddala.
8. Kebera oba nga DNS CAA likodi oba emenyeddwa DNSSEC eri kuziyiza ekitongole kyo ekya Certificate Authority okufulumya (CAA record for example.com prevents issuance):
9. Buuza Olukusa lw'Obuyinza Okuwa Satifikeeti ya domain yo (CAA) ebiwandiiko: dig +short CAA example.com. Singa DNS yo erina 0 issue "sectigo.com" oba 0 issue "amazon.com" (oba ku domain y'omuzadde), Ka Tusibe (letsencrypt.org) ne ZeroSSL (sectigo.com) zigaaniddwa RFC 8659 okufulumya okutuusa ng’oyongeddeko 0 issue "letsencrypt.org" okutuuka mu DNS zone yo.
10. Singa omwalo 80 (HTTP-01 challenge) ezibiddwa firewall, CDN, oba ISP, oba singa web server yo egaana okutandika olw'okubula cert, kozesa --standalone oba --dns (DNS-01) okukakasa:
11. Okulekera nginx/ .apache mu bufunze era odduke sudo certbot certonly --standalone -d example.com, oba okukozesa --manual --preferred-challenges dns okukakasa nga ossaako a _acme-challenge.example.com TXT kwata mu DNS console yo nga tokwata ku port 80.
12. Singa omukutu gwo gutuula emabega wa Cloudflare, AWS CloudFront, oba Fastly, kakasa oba satifikeeti eyaggwaako eri ku CDN Edge oba ku Origin Server yo (Error 526 Invalid SSL Certificate):
13. Ku Cloudflare, singa satifikeeti yo eya seva y'ensibuko eggwaako era Cloudflare eteekeddwa ku Full (Strict), abakozesa balaba Ensobi 526. Nga otereeza satifikeeti y'ensibuko, osobola okuzzaawo entambula y'omukutu omulamu mu sikonda 5 ng'okola satifikeeti ya Cloudflare Origin CA ey'emyaka 15 mu dashiboodi ya Cloudflare (oba okukyusa embeera ya SSL/TLS okuva ku Full (Strict) okutuuka ku Full okumala eddakiika 10 ezitwala okukyusa ensibuko .pem fayilo).

Omuti gw'okusalawo: okuzuula n'okutereeza satifikeeti y'okufulumya eya SSL/TLS eyaggwaako¶

Goberera omuti guno ogw'okusalawo okulaga obulungi layeri entuufu ey'okulemererwa (CDN Edge vs. Origin Daemon Memory vs. ACME Challenge vs. CA Rate Limit) n'okuzzaawo entambula ya HTTPS mu ddakiika:

flowchart TD
    Start["Abakozesa / APIs Okuloopa NET::ERR_CERT_DATE_INVALID oba Cloudflare Ensobi 526"] --> CheckLive["Run: openssl s_client -erinnya ly'omuweereza ekifo -okuyunga ekitundu:443 | openssl x509 -noout -ennaku -omufulumya"]

    CheckLive --> WhereExpired{"Mu butuufu Satifikeeti Ki Eggwaako?"}

    WhereExpired -->|"Disk fullchain.pem Ntuufu, Naye Live Port 443 EZE EKYA EXPIRED"| StaleDaemon["Stale Daemon Memory oba Split Cert Store: Ddamu okutikka nginx / apache2 / haproxy / postfix, oba Ddamu okuzimba ekibinja kya HAProxy PEM ekigatta"]
    WhereExpired -->|"CDN Edge Cert (Ekire / EkireFront / Mu bwangu) Eggwaako"| CDNFix["Kebera Ebiwandiiko bya DNS CAA ku CDN CA (letsencrypt.org / pki.goog / digicert.com / amazon.com) era Toggle Universal SSL oba Ddamu Okukakasa ACM"]
    WhereExpired -->|"Origin Server fullchain.pem ku Disk Eweddewo"| DryRun["Dduka: sudo certbot okuzza obuggya --dry-run (oba acme.sh -- okuzza obuggya -d domain --debug)"]

    DryRun --> WhyFailed{"Lwaki Okuzza obuggya ACME Kulemererwa?"}

    WhyFailed -->|"429 Okusaba Kungi Nnyo (Ekkomo ku Miwendo Liyisiddwa) ."| RateLimit["Bypass Amangu: Ensonga okuva ku ZeroSSL / Buypass / Google Trust Services OBA Yongera 1 Extra Subdomain SAN (-d fix1.example.com)"]
    WhyFailed -->|"CAA Record Eziyiza Okufulumya oba SERVFAIL (DNSSEC) ."| CAADNS["Duka: dig CAA example.com -> Yongera ensonga 0 'letsencrypt.org' (ne 'sectigo.com') oba Okutereeza DNSSEC DS Record Emenyese ku Registrar"]
    WhyFailed -->|"Okuyungibwa Kugaaniddwa / Ekiseera kiwedde / 404 ku /.well-known/acme-challenge/"| HttpBlock["Port 80 Blocked oba Redirect Loop: Ggulawo TCP Port 80 mu Firewall, Ggyako /.well-known/ okuva mu Auth/Rewrite, oba Kozesa DNS-01 Challenge"]
    WhyFailed -->|"Kubernetes cert-manager Ekiragiro Kikwatiddwa mu Kulindiridde"| K8sFix["Run: kubectl describe challenge -> Kebera Ingress class annotation, enkola y'omukutu gwa HTTP01 solver pod, oba Webhook TLS"]

    StaleDaemon --> VerifyAll["Kakasa Olujegere & OCSP Stapling: openssl s_client -okuyunga domain:443 -embeera"]
    CDNFix --> VerifyAll
    RateLimit --> VerifyAll
    CAADNS --> VerifyAll
    HttpBlock --> VerifyAll
    K8sFix --> VerifyAll

Omutendera 1: Okutegeera lwaki HSTS (Strict-Transport-Security) kireeta okuziba kw’amasannyalaze okulemererwa ddala¶

Omukutu bwe tegukozesa HSTS, satifikeeti eggwaako eraga okulabula okw'omu makkati (Your connection is not private) nga erina "Advanced -> Proceed to example.com (unsafe)" link esobozesa abakozesa abaggwaamu essuubi okunyiga.

Naye, kumpi enkola zonna ez’omulembe ez’okufulumya web applications, banks, SaaS platforms, ne... .dev / . .app / . .page / . .bank domains ez'omutendera ogw'oku ntikko zissa mu nkola HTTP Strict Transport Security (HSTS, RFC 6797) nga bwe kiri. 1. HSTS ekyukakyuka (max-age=31536000): Browser yonna ebadde ekyalidde omukutu gwo mu nnaku 365 eziyise yatereka enkola eno Strict-Transport-Security: max-age=31536000; includeSubDomains. Okutuusa nga ekiseera ekyo kiggwaako, browser egaana omukozesa okunyiga okuyita mu nsobi yonna eya satifikeeti (ERR_CERT_DATE_INVALID, . ERR_CERT_COMMON_NAME_INVALID, oba ERR_CERT_AUTHORITY_INVALID). 2. Okusooka okutikka HSTS okutambula (preload olukalala oba .dev / . .app gTLD): Singa domain yo yaweebwayo eri hstspreload.org - oba singa domain yo ekozesa Registry-Preloaded TLD nga .dev, . .app, . .page, . .new, . .chrome, oba .bank - buli kkopi ya Chrome, Edge, Firefox, Safari, ne Android WebView ku nsi erina domain yo hardcoded mu binary yaayo nga HSTS-enforced nga omukozesa tannagenda ku mukutu gwo omulundi gwe ogusoose. 3. Lwaki includeSubDomains emenya ebikozesebwa eby'omunda ne seva z'okuteeka mu mitendera: Singa root domain yo (example.com) asindika Strict-Transport-Security: max-age=31536000; includeSubDomains, buli kitundu ekitono (vpn.example.com, . internal-jira.example.com, . printer.example.com) era esibiddwa mu mbeera ya HSTS hard-fail. 4. Lwaki okugatta API ne Webhook (Stripe, . Twilio, . Slack, . iOS ATS) balemererwa mangu: Bakasitoma ba TLS okuva ku seva-ku-seva (libcurl, Omuwandiisi w’ebitabo requests/ .urllib3, Ensonga.js undici, Genda crypto/tls, Java SSLContext) okukola RFC 5280 enkakali notAfter okukakasa nga bwekiba era tebalina ndowooza ya mukozesa "okunyiga-okuyita." Mu kiseera ky'okuggwaako kwa TLS, webhooks za Stripe ne Shopify zijja kulemererwa okutuusa era ziyingire ennyiriri z'okuddamu okugezaako okudda emabega okw'ekitalo.

Omutendera 2: Okukebera mu ssekindi 60 - Ddala satifikeeti yazzibwa buggya dda ku disiki?¶

Mu bitundu nga 35 ku buli 100 eby'okufulumya Let's Encrypt outages, mu butuufu satifikeeti yazzibwa buggya ku disiki wiiki eziyise nga certbot.timer oba acme.sh, naye daemon ekola ekyaweereza satifikeeti enkadde eyaggwaako okuva ku RAM.

Omutendera 1: Geraageranya socket ya network live ku fayiro eri ku disiki¶

Dukanya ebiragiro byombi ku seva yo:

# Check what the live port 443 socket is presenting in RAM:
echo | openssl s_client -servername example.com -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates -serial

# Check what is actually sitting on the filesystem:
sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -subject -issuer -dates -serial

Omutendera 2: Okutereeza emitego 4 egya bulijjo egya "Renewed on Disk, Expired in RAM".¶

Phase 3: Fixing DNS CAA record blocks and DNSSEC validation failures¶

If you run sudo certbot renew --dry-run and see: - urn:ietf:params:acme:error:caa :: CAA record for example.com prevents issuance - urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A/CAA for example.com

1. How DNS CAA (RFC 8659) blocks certificate renewal¶

Every public Certificate Authority is legally required by the CA/Browser Forum Baseline Requirements to query DNS CAA records before issuing any certificate. The CA walks up the DNS tree from sub.app.example.com -> app.example.com -> example.com: - Bwe example.com has zero CAA records, any CA is allowed to issue. - Bwe example.com alina ne bwe kiba kimu CAA likodi (okugeza, 0 issue "amazon.com" added automatically when someone created an AWS CloudFront distribution, or 0 issue "digicert.com"), every other Certificate Authority on Earth is strictly forbidden from issuing a certificate for example.com or any of its subdomains. - Furthermore, if you are requesting a Wildcard certificate (*.example.com) and your domain defines a specific 0 issuewild "ca.example" tag, the CA checks the issuewild ebintu okusinga issue.

Diagnostic n'okutereeza amangu ku CAA bulooka:¶

1. Kebera CAA ebiwandiiko ku byombi erinnya ly'omukozi n'ekitundu eky'oku ntikko:

   dig +short CAA sub.example.com
   dig +short CAA example.com
   

2. Era kebera oba... sub.example.com ye a CNAME okusonga ku domain endala (Per RFC 8659, CAs nazo zikebera CAA ebiwandiiko ku bigendererwa bya CNAME).
3. Mu dashboard y'omuwa DNS wo (Cloudflare, Route 53, Cloud DNS, Namecheap), tosazaamu ebiriwo CAA ebiwandiiko ebikozesebwa CDN oba AWS ACM yo; mu kifo ky'ekyo, yongerako ebirala CAA records authorizing Let's Encrypt ne CAs zo ez'okutereka:

   example.com.  300  IN  CAA  0 issue "letsencrypt.org"
   example.com.  300  IN  CAA  0 issue "sectigo.com"
   example.com.  300  IN  CAA  0 issue "pki.goog"
   example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"
   example.com.  300  IN  CAA  0 issuewild "sectigo.com"
   

   (Weetegereze: ZeroSSL ekozesa sectigo.com nga ekimanyisa kyayo ekya CAA ekikulu, era Google Trust Services ekozesa pki.goog.) .
4. Linda sekondi 60 abaweereza bwo ab'amannya ab'obuyinza batereeze (dig @ns1.yourdns.com CAA example.com) era amangu ago okuddamu okudduka sudo certbot renew. Okuva CAs bwe zikola live recursive lookups nga ziyita ku public caches ku retry, okufulumya kutuuka ku buwanguzi amangu ddala.

2. Okutereeza DNS problem: SERVFAIL looking up CAA (DNSSEC obutakwatagana)¶

Ka tunyweze nnyo Encrypt, Google Trust Services, ne ZeroSSL mu nkola enkakali okukakasa kwa DNSSEC ku kunoonya kwonna okwa DNS (A, . AAAA, . TXT, ne CAA). Ne bwe kiba nti domain erina nedda CAA record, CA erina okufuna ekituufu mu cryptographically NOERROR (okuddamu ekyerere) oba NXDOMAIN (NSEC / . NSEC3 okugaana okubeerawo okukakasibwa) okuddamu. - Singa omuwandiisi wa domain yo akutte stale DS (Delegation Signer) okuwandiika oluvannyuma lw'okusenguka abagaba DNS (okugeza, okuva ku GoDaddy okudda ku Cloudflare oba Route 53 nga tosoose kulemesa DNSSEC), recursive resolvers ezikaka DNSSEC okudda SERVFAIL. - Kakasa mu sikonda 5: Dduka delv @8.8.8.8 example.com CAA oba okugezesa ku dnsviz.net. Singa dig @8.8.8.8 example.com akomawo status: SERVFAIL ate nga dig +cd @8.8.8.8 example.com (+cd = Okukebera Disabled, okubuusa amaaso DNSSEC) kuzzaayo endagiriro yo eya IP, olujegere lwo olwa DNSSEC lumenyese. Yingira mu domain registrar yo amangu ddala era oba oggyewo stale DS wandiika oba okukoppa ebiriwo kati DS parameters okuva ku DNS host yo ekola.

Omutendera 4: Okuyita ku Ka Tusibe Ekkomo ku Miwendo (429 Too Many Requests) mu kiseera ky’okuggwaako kw’amasannyalaze¶

Mu kiseera ky’akavuyo, bayinginiya batera okuddamu okutandika konteyina oba okudduka certbot enfunda eziwera okutuusa Let's Encrypt lw'egaana okusaba kwonna nga: - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168h0m0s - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many failed authorizations (5) recently

Ebiseera by’okulinda biva ku essaawa emu (ku lukusa olulemye) okutuuka ku ennaku 7 (essaawa 168) (ku kkomo lya satifikeeti 5 eziddirira). Tolinda ssaawa 1 oba ennaku 7 ng'omukutu gwo ogw'okufulumya guli wansi. Olina eby'okukola bibiri ebituufu ddala, eby'amangu:

Enkola A (Esinga obulungi): Kyusa ACME Certificate Authority okudda ku ZeroSSL, Buypass, oba Google Trust Services mu sikonda 30¶

Enkola ya ACME (RFC 8555) mutindo gwa open. Buli browser enkulu n'enkola y'emirimu yeesiga ZeroSSL (Sectigo root), Buypass Go SSL (Norwegian CA), ne Google Trust Services (pki.goog) identically to Ka Tusibe (ISRG Root X1). Tewali n'omu ku bo agabanya kkomo ku miwendo ne Let's Encrypt.

• Eky'okukola 1: Okufulumya amangu ddala nga oyita mu Certbot nga okozesa Buypass Go SSL (Tewali kisumuluzo kya akawunti/EAB kyetaagisa, okukola kwa nnaku 180): (Weetegereze: Buypass ewagira satifikeeti za domain eziwera okutuuka ku SAN 5, wadde nga si wildcard *.example.com certs)

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://api.buypass.com/acme/directory" \
    -d example.com -d www.example.com \
    --email admin@example.com --agree-tos
  

• Eky'okukola 2: Ensonga amangu ddala nga oyita mu acme.sh (esooka ku ZeroSSL oba ekyusa CAs na --server):

  # Using ZeroSSL:
  acme.sh --register-account -m admin@example.com --server zerossl
  acme.sh --issue -d example.com -d www.example.com -w /var/www/html --server zerossl
  

• Eky'okukola 3: Ensonga ng'oyita mu Google Trust Services (pki.goog) ACME ey'olukale: Mu Google Cloud Console (oba okuyita mu... gcloud publicca external-account-keys create), okukola Okusiba Akawunti ey’Ebweru ey’obwereere (EAB) ekisumuluzo mu sikonda 10 era odduke:

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://dv.acme-v02.api.pki.goog/directory" \
    --eab-kid "YOUR_EAB_KEY_ID" \
    --eab-hmac-key "YOUR_EAB_HMAC_KEY" \
    -d example.com -d www.example.com
  

Okugonjoola B: Yita ku kkomo lya Let's Encrypt "5 Duplicate Certificates" nga oyongerako erinnya limu ery'omukozi erya SAN ery'enjawulo¶

Ka Tusibe ekkomo ku ssaawa 168 ez'okukoppa (too many certificates (5) already issued for this exact set of domains) erondoola ekibiina ekituufu eky'ennukuta z'amannya g'omukozi wa SAN ku satifikeeti, so nga okutwalira awamu ekkomo lya Registered Domain liri satifikeeti 50 buli wiiki. 1. Tonda DNS etali ya bulabe A likodi esonga ku seva y'emu: tls-recovery-01.example.com -> <your_server_ip>. 2. Saba satifikeeti n'ebifo byo eby'olubereberye nga kw'ogasse erinnya ly'omukozi eppya:

sudo certbot certonly --nginx --cert-name example.com \
  -d example.com -d www.example.com -d tls-recovery-01.example.com

Omutendera 5: Okutereeza ebimenyese HTTP-01 okusoomoozebwa (Port 80) oba okukozesa DNS-01 okukakasa mu bwangu¶

Ddi certbot renew alemererwa ne Timeout during connect (likely firewall problem) oba Invalid response from http://example.com/.well-known/acme-challenge/...: 404 (oba 403), seeva z'okukakasa CA teziyinza kutuuka ku kabonero ko ak'okusoomoozebwa kwa HTTP ku TCP port 80.

Lwaki HTTP-01 omulundi gumu ekutuka ku seeva ezaakola ennaku 60 eziyise¶

1. Ekibiina ky'ebyokwerinda mu kire / UFW / iptables closed Port 80: Waliwo eyakakanyaza firewall okukkiriza port yokka 443 (HTTPS), okwerabira nti RFC 8555 HTTP-01 okukakasa bulijjo kutandika ku mwalo gwa HTTP ogwa bulijjo 80 (wadde nga kujja kugoberera a 301 okukyusa okudda ku https:// ku mwalo 443).
2. IPv6 emenyeke (AAAA) Record: Domain yo erina byombi IPv4 (A) likodi ne IPv6 ( .AAAA) ebiterekero. Katusibe Encrypt bulijjo ayagala nnyo IPv6 (AAAA) okusooka. Singa endagiriro yo eya IPv6 ekyusibwa, ezibiddwa ip6tables, oba obutasibiddwa mu Nginx (listen [::]:80;), obudde bw'okukakasa buweddewo wadde nga IPv4 ekola bulungi.
3. Nginx / Router y'okukozesa (React / . Next.js / . Django / . Rails) akwata /.well-known/acme-challenge/: Yo server block ku port 80 proxyes entambula yonna (location / { proxy_pass http://localhost:3000; }) ku app ya backend mu kifo ky'okuweereza .well-known okuva ku disiki.

Ebintu bibiri eby’amangu ebitereezeddwa ku bimenyese HTTP-01 okukakasa¶

Fix 1: Okwongerako ekintu ekyewaddeyo eky’okukulembeza ennyo /.well-known/acme-challenge/ bbulooka mu Nginx (Omwalo 80) .¶

Kakasa nti port yo 80 block mu /etc/nginx/sites-enabled/ eweereza ACME tokens butereevu okuva /var/www/letsencrypt nga tannabaawo return 301 https://... oba proxy_pass ekiragiro:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

sudo mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
sudo nginx -t && sudo systemctl reload nginx
sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com

Fix 2: Bypass Port 80 ne web servers ddala nga olina manual DNS-01 (TXT) okusoomozebwa¶

Singa port 80 ezibiddwa ISP/firewall eya waggulu oba load balancer yo tesobola kuyisa .well-known ku nodes eziwera ez'emabega, kakasa ng'oyita mu DNS mu ddakiika 2:

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

dig +short TXT _acme-challenge.example.com @8.8.8.8

Omutendera 6: Okukakasa oluvannyuma lw’okudda engulu (Intermediate Chain, OCSP Stapling, ne CDN Purge) .¶

Ensobi etera okukolebwa oluvannyuma lw’okukyusa satifikeeti ey’amangu kwe kussaako cert.pem (satifikeeti y’amakoola yokka) mu kifo kya fullchain.pem (satifikeeti y'amakoola + satifikeeti ya CA ey'omu makkati). Ebikozesebwa ku mmeeza (Chrome, . Firefox) batera okusiba satifikeeti ey’omu makkati ebula nga bayita mu AIA (Authority Information Access) okugoba oba okutereka eby’omu makkati, ate nga ** .curl, Python, OpenSSL, Android apps, ne Stripe/Twilio webhooks zilemererwa amangu ddala ne unable to verify the first certificate (SSL certificate problem: unable to get local issuer certificate)**.

• Kakasa nti seva yo esindika Intermediate Chain enzijuvu (fullchain.pem): Okudduka:

  echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | grep -E "Verify return code|depth="
  

  Olina okulaba waakiri emitendera ebiri (depth=0 domain yo era depth=1 CA ey’omu makkati nga Let's Encrypt E5/ .R11 oba ZeroSSL RSA Domain Secure Site CA) ne ** .Verify return code: 0 (ok)**. Bw’oba ​​olaba Verify return code: 21 (unable to verify the first certificate), kyusa ensengeka yo eya web server okuva cert.pem okutuuka ku fullchain.pem.
• Okulongoosa ekifo ekikadde ekya OCSP Stapling mu Nginx / Apache: Bwe ssl_stapling on; ekoleddwa, ddamu okutikka web server era okebere openssl s_client -servername example.com -connect example.com:443 -status 2>/dev/null | grep -A 15 "OCSP response".
• Tegeka okulondoola okuggwaako kwa SSL okw'emitendera mingi (External TCP check + Prometheus blackbox_exporter): Tosigamangako ku kujjukiza kwa email kwokka (Let's Encrypt emails ezijjukiza okuggwaako eziyimiriziddwa mu 2025). Londoola socket ya live port 443 ebweru (probe_ssl_earliest_cert_expiry - time() < 86400 * 14) era oteekewo cron check ya buli lunaku ku sudo certbot renew --dry-run.

Ennamba z’embeera ez’amangu mu bitundu n’ebiragiro by’ebitongole¶

Wadde nga satifikeeti ya TLS eweddeko etera okugonjoolwa ttiimu za yinginiya, okuvaako kwa satifikeeti okumenya emikutu gy’ebyobulamu, webhooks z’okusindika mu bwangu, okukakasa bbanka, oba ebikozesebwa bya gavumenti ebya gavumenti kuyinza okuleeta enkola y’emirimu gy’ebibaddewo mu mateeka:

• Amerika ne Canada:
• Obulamu-Obukuumi / Obujjanjabi / Okuvaako kw'okusindika: Dial 911 singa okulemererwa kwa satifikeeti ya TLS kusalako okupima omulwadde okuva ku ssimu, okuwandiika ku yintaneeti, oba empuliziganya ey’okusindika mu bwangu.
• Ekitongole ekivunaanyizibwa ku by'okwerinda ku mikutu gya yintaneeti n'ebizimbe (CISA) (US): Ebitongole by’abantu baabulijjo ebya Federo wansi wa CISA Binding Operational Directive (BOD) 18-01 n’abaddukanya ebizimbe ebikulu abafuna okugaba satifikeeti ezitakkirizibwa (CA compromise oba BGP/DNS hijacking) zirina okuloopa eri 1-844-Say-CISA (1-844-729-2472) oba cisa.gov/report.
• Ekitongole kya Canada ekikola ku by'okwerinda ku mikutu gya yintaneeti: Tuukirira 1-833-CYBER-88 (1-833-292-3788).
• Obwakabaka bwa Buganda:
• Empeereza ey'amangu: Kuba 999 singa okuvaako kwa TLS kukosa enkola z’obujjanjabi za NHS ezikulu oba obukuumi bw’obulamu.
• Ekitongole ky'eggwanga eky'ebyokwerinda ku mikutu gya yintaneeti (NCSC): Singa ozuula satifikeeti etakkirizibwa efulumiziddwa ku domain yo mu Certificate Transparency (crt.sh) ebiwandiiko ebiraga okuwambibwa kwa DNS, lipoota okuyita mu ncsc.gov.uk.
• Omukago gwa Bulaaya:
• Empeereza ey'amangu: Kuba 112 mu mawanga gonna agali mu mukago gwa EU.
• Ebbaluwa za NIS2 Directive & eIDAS ezirina ebisaanyizo ebikakasa omukutu gwa yintaneeti (QWACs): Ebitongole ebikulu era ebikulu wansi w’ekiragiro kya NIS2 ebifuna okuvaako kw’okubeerawo okumala ebbanga oba ebisumuluzo bya PKI ebikoseddwa birina okutegeeza CSIRT yaabwe ey’eggwanga mu ssaawa 24.
• Australia ne New Zealand:
• Empeereza ey'amangu: Kuba 000 mu Australia oba 111 mu New Zealand; tuukirira ACSC (1300 CYBER1) olw’ebintu ebibaawo mu bikozesebwa.
• Buyindi ne Asia-Pacific:
• Ebuyindi (CERT-In / Omufuzi w’ebitongole ebikakasa CCA): Kuba essimu 112 olw’okuddamu mu mbeera ez’amangu; lipoota PKI compromise oba okukutuka kw’ebikozesebwa okunene eri incident@cert-in.org.in mu ssaawa 6 zokka.

Ebibuuzo ebitera okubuuzibwa¶

Lwaki nze oba abakozesa bange sisobola kunyiga "Advanced -> Proceed to site (unsafe)" mu Chrome oba Safari mu kiseera kino eky'okuggwaako?¶

Domain yo bwesindika... Strict-Entambula-Obukuumi (HSTS) HTTP header - oba ekozesa domain ey'omutendera ogw'oku ntikko nga .dev, . .app, . .omuko, oba .banka nti hardcoded mu browser HSTS Preload List - RFC 6797 yeetaaga browser okutwala satifikeeti yonna eggwaako, eyeeteekako omukono, oba etakwatagana ng'ensobi etta etasobola kuddamu. Browser eggyawo mu bugenderevu bbaatuuni ya "Proceed anyway" bypass okutangira abalumbaganyi abakola Man-in-the-Middle (MitM) okulimba abakozesa okunyiga okuyita mu satifikeeti eriko obufere. So nga omukugu ku desktop Chrome asobola okuwandiika ensengeka ya keyboard enkweke kino kitali kya bulabe butereevu ku screen y'ensobi okugiyitako mu kitundu okugezesa, abakozesa abatuufu tebasobola; olina okuteeka satifikeeti entuufu ku port 443.

Let's Encrypt yalekera awo okusindika emails ezilabula okuggwaako era cert yange n'eggwaako awatali kutegeeza - lwaki ekyo kyaliwo?¶

Let’s Encrypt yawummuza mu butongole empeereza yaayo eya email etegeeza okuggwaako mu makkati ga 2025 okukendeeza ku nsimbi ezisaasaanyizibwa mu kukuuma data era kubanga ensengeka za ACME ez’obwengula zirina okulondoola obulamu bw’okuzza obuggya butereevu. Okuziyiza ebyewuunyisa eby'omu maaso, olina okulondoola ekiseera kyennyini eky'okuggwaako kw'okukwatagana mu ngalo kwa TLS ku mutimbagano ng'okozesa omulondozi w'obudde bw'okukola obw'ebweru (nga Prometheus blackbox_omufulumya ebweru w'eggwanga, Uptime Kuma, Better Stack, oba Datadog Synthetic TLS checks) okulabula ku nnaku 21, ennaku 14, n'ennaku 7 nga tezinnabaawo siOluvannyuma.

Lwaki omukutu gwange gukola bulungi mu Chrome ne Firefox ku laptop yange, naye ne gulemererwa ku masimu ga Android, curl, ne Stripe webhooks nga mmaze okulongoosa satifikeeti?¶

Wategeka web server yo (ssl_satifikeeti mu Nginx oba Fayiro y'ebbaluwa ya SSLC mu Apache) okusonga ku cert.pem (satifikeeti y’amakoola yokka) mu kifo kya omujegere omujjuvu.pem (satifikeeti y’amakoola eyungiddwa wamu ne satifikeeti ya Intermediate CA). Desktop browsers nga Chrome ne Firefox ziwanula otomatika satifikeeti ez’omu makkati ezibula mu mugongo nga zikozesa... Okufuna amawulire mu kitongole (AIA) . URL munda mu leaf cert yo, okukweka okusengeka obubi kwa seva yo. Naye, curl, OpenSSL, Android's system trust verifier, Python, ne webhook servers tezikola AIA chasing era amangu ago zigaana okuyungibwa ne obutasobola kufuna satifikeeti y'omugaba ow'omu kitundu. Laga config yo ku omujegere omujjuvu.pem era oddemu okutikka seva yo.

Nkebera ntya oba omubbi oba admin omufere yafulumya satifikeeti ya SSL etakkirizibwa ku domain yange?¶

Buli kitongole kya Satifikeeti ekyesigika mu lujjudde kyetaagisa okuwandiika buli satifikeeti efulumiziddwa mu lujjudde Certificate Transparency (CT) logs (RFC 6962) nga browsers tezinnaba kukyesiga. Okuggula https://crt.sh/?q=%25.omukutu gwo.com oba Cloudflare's Certificate Transparency Monitor okulaba buli satifikeeti ebadde efulumizibwa ku domain yo ne subdomains zaayo. Bw’olaba satifikeeti efulumiziddwa CA gy’otomanyi gy’otokkiriza, kebera mangu omuwandiisi wo owa DNS n’ekitundu kya DNS ekirimu obuyinza oba tewali nkyukakyuka ezitakkirizibwa, sazaamu satifikeeti ey’obulimba ne CA egaba, era osibe DNS yo nayo CAA records (`0 issue "letsencrypt.org"`).

Watya singa ekibinja kyange ekya Kubernetes cert-manager failed to renew our Ingress certificate and the Order is stuck in Pending?¶

Dduka kubectl get order,challenge -A n’oluvannyuma kubectl describe challenge <challenge-name> -n <namespace>. In 90 percent of Kubernetes cert-manager outages, the cm-acme-http-solver-* pod ey'ekiseera ekola, naye oba (1) ekintu kya Ingress kirina annotation ya ingress class evudde ku mulembe kale ekkubo ly'omugonjoola terikwataganangako ku load balancer yo, (2) a Kubernetes NetworkPolicy is blocking ingress traffic to the solver pod on port 8089, or (3) a hair-pin NAT / split-horizon DNS issue prevents cert-manager's internal self-check from reaching your public load balancer IP (fixable by passing --dns01-abaweereza-amannya-abaddamu=8.8.8.8:53,1.1.1.1:53 okutuuka ku cert-manager okuteekebwa mu nkola args).

Nsobola okukoppa ebyange /etc/letsencrypt/ folda ku seva empya mu kiseera ky'okusenguka okw'amangu mu kifo ky'okuddamu okufulumya?¶

Yee. Singa seva yo enkulu yafa era ng'ogenda ku seva empya nga rate-limited by Let's Encrypt, kuuma symlinks nga okoppa /etc/letsencrypt/ . nga bakozesa tar -czpf leka ensirifu_okutereka.tar.gz /etc/leka ensirifu (tokozesangako kya bulijjo scp -r, ekikyusa symlinks mu /etc/letsencrypt/okubeera omulamu/ mu fayiro ezitali zimu ezikoppiddwa era n’emenya okuzza obuggya mu biseera eby’omu maaso). Ggyayo archive eyo ku server empya (`sudo tar -xzpf letsencrypt_backup.tar.gz -C /`), songa Nginx/Apache ku `/etc/letsencrypt/live/domain/fullchain.pem`, era satifikeeti yo eriwo ejja kukola amangu ddala ku ndagiriro ya IP empya.

Ebiragiro ebikwatagana nabyo¶

• Okuwamba amannya ga domain, DNS eggwaako, n'okutwala omukutu gwa yintaneeti
• Disiki ya seva 100% ejjudde (0 bytes free): database ne zero-space okuzzaawo
• Google Workspace oba Microsoft 365 custom domain admin okuggalawo n'okutaasa DNS TXT
• Ekizibu ky'okukyaza omukutu, okusenguka, n'okuzzaawo backup
• Okuwamba DNS, okuddamu okusengeka WAN router ya ISP, n'okukoppa portal mu buwambe
• Ennamba z’amangu okusinziira ku nsi

Ensonda n’obulagirizi obutongole¶

• Ekibiina ekikola ku by’okukola yinginiya wa yintaneeti (IETF): RFC 8555 (Embeera y’okuddukanya satifikeeti mu ngeri ey’obwengula / ACME), RFC 8659 (Olukusa lw’ekitongole ekigaba satifikeeti ya DNS / CAA), ne RFC 6797 (HTTP Strict Transport Security / HSTS).
• Ekitongole ky’eggwanga ekikola ku mutindo ne tekinologiya (NIST) (United States): Ekiwandiiko eky’enjawulo 800-52 Rev. 2: Enkola y’okulonda, okusengeka, n’okukozesa enkola z’obukuumi bw’omutendera gw’entambula (TLS) & SP 1800-16: Okukuuma Enkolagana ya Web: Okuddukanya satifikeeti za TLS Server.
• Ekibiina ekinoonyereza ku by’okwerinda ku yintaneeti (ISRG / Ka Tusibe Ebiwandiiko Ebitongole): Okujuliza ekkomo ku miwendo, Amateeka ga Satifikeeti agakoppa, n'okugonjoola ebizibu by'okusoomoozebwa kwa ACME.
• Ekitongole ky’ebyokwerinda ku mikutu gya yintaneeti n’ebizimbe (CISA) (Amerika): Ekiragiro ky’emirimu ekisiba 18-01: Okwongera ku bukuumi bwa Email ne Web (HTTPS ne HSTS Implementation Guidance).
• Ekitongole ky’eggwanga eky’ebyokwerinda ku mikutu gya yintaneeti (NCSC) (United Kingdom): Okukozesa TLS okukuuma Data mu ngeri entuufu mu ntambula n’obulagirizi bw’okulondoola obwerufu mu satifikeeti.