Gaosiga SSL/TLS Tusi Fa'ailo ua uma: Fa'amauina HSTS Malosi-Fail Outages ma Tatou fa'aigoa CAA/Rate-Limit Blocks¶

Pe a faia se gaosiga SSL/TLS (HTTPS) tusi faamaonia e muta - e tusa lava pe tasi le sekone ua tea notAfter UTC timestamp - so'o se su'esu'ega fa'aonaponei (Chrome, Safari, Firefox, Edge), telefoni feavea'i (iOS App Transport Security, Android Network Security Config), mea e maua ai upegatafa'ilagi (Stripe, Shopify, Twilio, GitHub), ma le tagata o tausia API i luga e vave motusia feso'ota'iga ma NET::ERR_CERT_DATE_INVALID pe SSL_ERROR_RX_RECORD_TOO_LONG. Ae sili atu ona leaga, pe afai e auina atu e lau vaega le Strict-Transport-Security (HSTS) ulutala poʻo ua tuʻufaʻatasia i totonu o le browser ** HSTS Preload List**, Chrome ma Safari aveese le "Advanced -> Proceed to site (le saogalemu)" bypass button atoa, ma iʻu ai i le 100 pasene faigata-failout blackout mo tagata uma i le lalolagi atoa. O le tele o taimi, o le fa'afouga otometi cronjob (Certbot, acme.sh, Caddy, cert-manager, pe AWS ACM) ua le leoa mo le 30 aso ona o se DNS faʻatapulaʻa CAA faamaumauga, o se DNSSEC gau DS fa'amaumauga, ose puipui puipui uafu 80 (HTTP-01 lu'i), po'o se 'upega tafa'ilagi (nginx / haproxy) na fa'afouina le faila i luga o le disk (fullchain.pem) ae e le'i toe fa'ae'e lava ana fa'agaioiga i totonu o le tagata faigaluega. Afai o lou motusia na mafua ona o le mae'a o le aoga o le resitalaina o igoa po'o le faoa igoa nai lo le tusi pasi X.509 lava ia, sui vave i le faoa igoa ole igoa ole igoa ole igoa ole igoa ole igoa, DNS ua uma le aoga, ma le fa'aaogaina ole upegatafa'ilagi; pe afai e matua le mafai ona aapa atu lau server pe leai foi se avanoa tisiki o lea certbot e le mafai ona tusi atu i ai /etc/letsencrypt, vaai tisiki server 100% atoatoa ma leai se avanoa toe faaleleia pe faʻalavelave faʻafeiloaʻi i luga o le upega tafaʻilagi, femalagaiga, ma le toe faʻaleleia. Afai e fa'amalo e lenei TLS fa'aleaogaina le telemetry a le falema'i, fa'alavelave fa'afuase'i APIs, po'o le saogalemu lautele, vala'au lau numera fa'alavelave fa'afuase'i (911 i le Iunaite Setete ma Kanata, 112 i totonu o le Iuni a Europa, 999 i Peretania) pe fa'afeso'ota'i la matou lisi fa'avaomalo o numera fa'afuase'i.

Fai nei loa¶

1. Siaki ile 10 sekone pe ua uma ona faafou le tusipasi i luga ole tisiki, ma ua le mafai e lau 'upega tafaʻilagi poʻo le load balancer ona toe faʻaleleia i le RAM:
2. Faatusatusa le socket TLS ola i le .pem faila ile disk ile taimi nei:

   # 1. What the live server is serving over the network:
   echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -serial
   # 2. What is actually sitting on disk in /etc/letsencrypt/live/:
   sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -issuer -serial
   

3. ** Afai o le faila i luga o le disk o loʻo faʻaalia se lumanaʻi aoga notAfter aso a o le uafu ola 443 fa'aalia se aso ua muta**: O lau kalani ACME (certbot / acme.sh) manuia vaiaso ua mavae, ae nginx, apache2, haproxy, pe postfix e le'i toe utaina, pe (haproxy / vault) e manaʻomia fullchain.pem + privkey.pem fa'atasi i le fusi e tasi. Taufetuli sudo nginx -t && sudo systemctl reload nginx (po o sudo systemctl reload apache2 haproxy) ma o le a fa'amuta lau ta'oto ile 2 sekone.
4. Aua le tamoe certbot renew --force-renewal fa'afia i totonu o se matasele pe a fa'afou le fa'afouga: Let's Encrypt fa'amalosia le fa'atapula'aina o fua faatatau o 5 kopi fa'alua i le 7 aso ma le 5 fa'amaonia le fa'amaonia i le teugatupe, i le igoa talimalo, i le itula. Tamomoe --force-renewal fa'alima i le popolevale e aunoa ma le fa'amautuina o le fa'avae nginx toe uta po'o le DNS/firewall bug o le a loka ai lau vaega mai le Let's Encrypt fa'atagaga mo le 7 aso.
5. Afai e te lavea se Let's Encrypt Rate Limit (429 Too Many Requests), fesuia'i lau kalani ACME i se Pulega Tusi Faamaonia lona lua e leai se totogi (ZeroSSL, Buypass Go SSL, pe Google Trust Services) po'o le fa'aopoopoina vave o se subdomain SAN:
6. Soo se tagata fa'atau ACME (certbot, acme.sh, caddy, cert-manager) e mafai ona talosagaina se tusi faamaonia faatuatuaina saoloto mai se CA ese i le 30 sekone (--server https://acme.zerossl.com/v2/DV90 pe https://api.buypass.com/acme/directory), fa'asolo atoa le fa'atapula'a o fua faatatau o Let's Encrypt.
7. E le gata i lea, o le fa'atapula'a a le Let's Encrypt's "5 kopi fa'alua i aso 7" e fa'atatau i le seti tutusa tonu o Su'esu'ega Su'esu'e Igoa (SANs). Fa'aopoopoina se isi subdomain aoga (-d example.com -d www.example.com -d tlsfix1.example.com) e fai ma tusi pasi e le toe fa'aluaina ma fa'ato'a pasia le fa'atapula'a o fua faatatau o le Tusi Fa'alua.
8. ** Siaki pe o se DNS CAA faamaumauga pe malepe DNSSEC o lo'o poloka lau Pulega Tusi Faamaonia mai le tu'uina atu (CAA record for example.com prevents issuance)**:
9. Su'esu'e le Fa'atagaga a le Pulega Fa'ailoga (CAA) faamaumauga: dig +short CAA example.com. Afai ei ai lau DNS 0 issue "sectigo.com" pe 0 issue "amazon.com" (po'o luga o se fa'alapotopotoga matua), Tatou Fa'ailoga (letsencrypt.org) ma ZeroSSL (sectigo.com) e faʻasaina e le RFC 8659 mai le tuʻuina atu seia e faʻaopoopoina 0 issue "letsencrypt.org" i lau sone DNS.
10. ** Afai uafu 80 (HTTP-01 lu'i) o lo'o poloka e se pa puipui, CDN, po'o le ISP, pe afai e musu lau 'upega tafa'ilagi e amata ona o se tusipasi e misi, fa'aoga --standalone pe --dns (DNS-01) fa'amaonia**:
11. Taofi nginx/apache puupuu ma tamoe sudo certbot certonly --standalone -d example.com, poʻo le faʻaaogaina --manual --preferred-challenges dns e fa'amaonia e ala i le faapipii a _acme-challenge.example.com TXT fa'amaumau i totonu o lau fa'amafanafana DNS e aunoa ma le pa'i i le taulaga 80.
12. ** Afai e nofo lau 'upega tafaʻilagi i tua o Cloudflare, AWS CloudFront, poʻo le Fastly, faʻamaonia pe o le tusi pasi ua maeʻa o loʻo i luga o le CDN Edge poʻo luga o lau Origin Server (Error 526 Invalid SSL Certificate)**:
13. I luga o Cloudflare, pe a maeʻa lau tusi faʻamaumauga a le amataga ma ua seti Cloudflare i Full (Strict), va'ai tagata fa'aoga Error 526. A'o e fa'aleleia le fa'ailoga o le amataga, e mafai ona e toe fa'afo'isia feoaiga i luga ole laiga i le 5 sekone e ala i le fa'atupuina o le 15-tausaga Cloudflare Origin CA certificate i le Cloudflare dashboard (pe sui le tumau SSL/TLS mode mai Full (Strict) ia Full mo le 10 minute e sui ai le amataga .pem faila).

Laau fa'ai'uga: su'esu'eina ma fa'asa'oina se tusi pasi SSL/TLS ua mae'a le gaosiga¶

Mulimuli i le la'au fa'ai'uga lenei e fa'ailoa tonu ai le fa'ailoga fa'aletonu (CDN Edge vs. Origin Daemon Memory vs. ACME Challenge vs. CA Rate Limit) ma toe fa'afo'i le fe'avea'i HTTPS i minute:

flowchart TD
    Start["Tagata fa'aoga / API Lipoti NET::ERR_CERT_DATE_INVALID po'o le Cloudflare Error 526"] --> CheckLive["Tamomoe: openssl s_client -servername domain -connect domain:443 | openssl x509 -noout -dates -tuuina atu"]

    CheckLive --> WhereExpired{"O le fea Tusi Faamaonia ua muta?"}

    WhereExpired -->|"Disk fullchain.pem E FA'AMANA, A'o le Live Port 443 Ua UMA"| StaleDaemon["Stale Daemon Memory poʻo le Split Cert Store: Toe sii le nginx / apache2 / haproxy / postfix, poʻo le Toe Fausiaina Tuʻufaʻatasia HAProxy PEM Bundle"]
    WhereExpired -->|"CDN Edge Cert (Cloudflare / CloudFront / Fastly) Ua muta"| CDNFix["Siaki DNS CAA Records mo CDN CA (letsencrypt.org / pki.goog / digicert.com / amazon.com) ma Toggle Universal SSL poʻo Re-Validate ACM"]
    WhereExpired -->|"Origin Server fullchain.pem i luga ole Disk Ua TA'E"| DryRun["Tamomoe: sudo certbot renew --dry-run (poo acme.sh --renew -d domain --debug)"]

    DryRun --> WhyFailed{"Aisea na le manuia ai le fa'afouina o le ACME?"}

    WhyFailed -->|"429 Tele naua Talosaga (Fa'agata Fa'asili atu)"| RateLimit["Fa'asolo loa: Fa'amatalaga mai le ZeroSSL / Buypass / Google Trust Services PO'O LE Fa'aopoopo 1 Fa'aopoopo Subdomain SAN (-d fix1.example.com)"]
    WhyFailed -->|"Fa'amaumauga a le CAA e taofia le tu'uina atu po'o le SERVFAIL (DNSSEC)"| CAADNS["Tamo'e: eli CAA example.com -> Fa'aopoopo 0 lomiga 'letsencrypt.org' (ma le 'sectigo.com') po'o le Fa'amauina DNSSEC DS ua gau i le Resitara"]
    WhyFailed -->|"Te'ena So'oga / Taimi / 404 on /.well-known/acme-challenge/"| HttpBlock["Taulaga 80 Ua poloka po'o Toe Fa'asa'o Loop: Tatala le TCP Port 80 ile Pa puipui, Va'aia /.lelei-fa'ailoa/ mai le Auth/Rewrite, po'o le Fa'aoga DNS-01 Challenge"]
    WhyFailed -->|"Kubernetes cert-manager Poloaiga Ua Taofia i Talialia"| K8sFix["Tamo'e: kubectl fa'amatala lu'i -> Siaki fa'amatalaga vasega Ingress, HTTP01 solver pod network policy, po'o Webhook TLS"]

    StaleDaemon --> VerifyAll["Fa'amaonia filifili & OCSP Stapling: openssl s_client -fa'afeso'ota'i vaega:443 -tulaga"]
    CDNFix --> VerifyAll
    RateLimit --> VerifyAll
    CAADNS --> VerifyAll
    HttpBlock --> VerifyAll
    K8sFix --> VerifyAll

Vaega 1: Malamalama pe aisea HSTS (Strict-Transport-Security) e mafua ai le pe a matua le mafai¶

A le fa'aogaina e le 'upega tafa'ilagi le HSTS, o le tusi pasi ua mae'a e fa'aalia ai se lapataiga fa'alavelave (Your connection is not private) fa'atasi ai ma le "Advanced -> Fa'agasolo ile example.com (le saogalemu)" so'otaga e mafai ai e tagata fa'atauva'a ona kiliki.

Ae ui i lea, toetoe lava o faʻaonaponei faʻaonaponei upega tafaʻilagi talosaga, faletupe, SaaS platforms, ma .dev / .app / .page / .bank fa'amalosi vaega pito i luga ** HTTP Strict Transport Security (HSTS, RFC 6797): 1. ** HSTS malosi (max-age=31536000): So'o se su'esu'ega na asia lau 'upega tafa'ilagi i totonu o le 365 aso ua tuana'i, natia le faiga fa'avae Strict-Transport-Security: max-age=31536000; includeSubDomains. Se'ia uma le taimi, o le browser fa'asa le tagata fa'aoga mai le kilikiina o so'o se fa'ailoga sese (ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID, pe ERR_CERT_AUTHORITY_INVALID). 2. ** Fa'atonu HSTS mua'i uta (preload lisi po o .dev / .app gTLD): Afai na tu'uina atu lau vaega i hstspreload.org - pe afai e fa'aogaina e lau 'au'aunaga se TLD Resitala-Preloaded pei .dev, .app, .page, .new, .chrome, pe .bank - o kopi uma o Chrome, Edge, Firefox, Safari, ma le Android WebView i luga o le Lalolagi o loʻo faʻapipiʻiina lau vaega i lana binary e pei o le HSTS-faʻamalosia aʻo leʻi asiasi le tagata faʻaoga i lau saite mo le taimi muamua. 3. ** Aisea includeSubDomains talepe mea faigaluega i totonu ma fa'atulagaina sa'o: Afai o lau vaega a'a (example.com) auina atu Strict-Transport-Security: max-age=31536000; includeSubDomains, so'o se subdomain (vpn.example.com, internal-jira.example.com, printer.example.com) o lo'o lokaina fo'i ile HSTS fa'aletonu faiga. 4. Aisea ua tuufaatasia ai API ma Webhook (Stripe, Twilio, Slack, iOS ATS) le manuia i le taimi lava lena: Server-to-server TLS clients (libcurl, Python requests/urllib3, Node.js undici, Alu crypto/tls, Iava SSLContext) fai le RFC 5280 notAfter fa'amaonia e ala i le fa'aletonu ma e leai se manatu o se tagata fa'aoga "kiliki" I le taimi ole TLS, Stripe ma Shopify webhooks o le a le mafai ona tuʻuina atu ma ulu atu i le tele o laina toe taumafai.

Vaega 2: Ole su'esu'ega 60-lua - Po'o ua uma ona fa'afouina le tusi pasi ile tisiki?¶

Pe tusa o le 35 pasene o le gaosiga Let's Encrypt outages, o le tusi faamaonia na toe faafou i luga o le tisiki vaiaso talu ai e certbot.timer pe acme.sh, ae o loʻo tuʻuina atu e le daemon tamoʻe le tusi pasi tuai mai le RAM.

Laasaga 1: Faʻatusatusa le socket network socket i luga o le faila faila¶

Fa'asolo uma tulafono i lau 'au'aunaga:

# Check what the live port 443 socket is presenting in RAM:
echo | openssl s_client -servername example.com -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates -serial

# Check what is actually sitting on the filesystem:
sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -subject -issuer -dates -serial

Laasaga 2: Faʻamau le 4 masani "Faʻafouina i luga ole Disk, Faʻamutaina ile RAM" mailei¶

Vaega 3: Fa'amauina DNS CAA poloka faamaumauga ma DNSSEC faaletonu o le faamaoniga¶

Afai e te tamoe sudo certbot renew --dry-run ma vaai: - urn:ietf:params:acme:error:caa :: CAA record for example.com prevents issuance - urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A/CAA for example.com

1. Fa'afefea DNS CAA (RFC 8659) poloka le faafouga o tusi faamaonia¶

E mana'omia fa'aletulafono e le CA/Browser Forum Baseline Manaoga a le lautele lautele e fa'asili ai le DNS CAA fa'amaumauga a'o le'i tu'uina atu so'o se tusi pasi. O le CA e savali ** i luga le DNS laau ** mai sub.app.example.com -> app.example.com -> example.com: - Afai example.com e leai se ** CAA fa'amaumauga**, so'o se CA e fa'atagaina e tu'uina atu. - Afai example.com ua ** e tasi lava CAA faamaumauga** (mo se faataitaiga, 0 issue "amazon.com" fa'aopoopo otometi pe a faia e se tasi se fa'asoa AWS CloudFront, po'o 0 issue "digicert.com"), o isi Pulega Tusipasi uma i luga o le Lalolagi e matua faasaina mai le tuuina atu o se tusi faamaonia mo example.com po'o so'o se tasi o ona subdomains. - E le gata i lea, afai o loʻo e talosagaina se Wildcard certificate (*.example.com) ma o lau vaega o lo'o fa'amatalaina se mea fa'apitoa 0 issuewild "ca.example" tag, e siaki e le CA le issuewild meatotino nai lo issue.

Su'esu'ega ma fa'avave vave mo CAA poloka:¶

1. Siaki CAA faʻamaumauga i luga uma o le igoa talimalo ma le pito i luga:

   dig +short CAA sub.example.com
   dig +short CAA example.com
   

2. Siaki foi pe sub.example.com o le a CNAME faasino i se isi vaega (Per RFC 8659, CAs foi siaki le CAA fa'amaumauga ile CNAME sini).
3. I le lisi o lau DNS providers (Cloudflare, Route 53, Cloud DNS, Namecheap), ** aua le tapeina o loʻo iai CAA fa'amaumauga** fa'aogaina e lau CDN po'o le AWS ACM; ae, faaopoopo faaopoopo CAA fa'amaumauga e fa'atagaina Let's Encrypt ma au fa'amaumauga CA:

   example.com.  300  IN  CAA  0 issue "letsencrypt.org"
   example.com.  300  IN  CAA  0 issue "sectigo.com"
   example.com.  300  IN  CAA  0 issue "pki.goog"
   example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"
   example.com.  300  IN  CAA  0 issuewild "sectigo.com"
   

   (Manatua: ZeroSSL fa'aoga sectigo.com e pei o lona fa'ailoaina autu o le CAA, ma le Google Trust Services e fa'aogaina pki.goog.)
4. Faatali mo le 60 sekone mo lau pule igoa igoa e faʻafou (dig @ns1.yourdns.com CAA example.com) ma toe tamo'e loa sudo certbot renew. Talu ai e fa'atino e le CA su'esu'ega toe fa'afo'i ola e alo ese ai le fa'aogaina o mea fa'alaua'itele i le toe fa'ata'ita'iga, e vave lava ona fa'amanuiaina le tu'uina atu.

2. Fa'amauina DNS problem: SERVFAIL looking up CAA (DNSSEC le fetaui)¶

Let's Encrypt, Google Trust Services, ma ZeroSSL faʻamalosia malosi ** DNSSEC validation** i suʻesuʻega DNS uma (A, AAAA, TXT, ma CAA). E tusa lava pe iai se vaega ole leai CAA fa'amaumauga, e tatau ona maua e le CA se fa'amatalaga fa'amaonia NOERROR (tali gaogao) po o NXDOMAIN (NSEC / NSEC3 faafitia fa'amaoni o le ola) tali. - Afai o lo'o fa'aletonu lau resitala DS (Delegation Signer) faʻamaumauga pe a uma ona e faʻauluina DNS providers (mo se faʻataʻitaʻiga, siitia mai GoDaddy i Cloudflare poʻo le Auala 53 e aunoa ma le faʻamalo muamua DNSSEC), toe faʻafoʻi faʻafitauli e faʻamalosia le toe faafoi DNSSEC SERVFAIL. - Fa'amaonia ile 5 sekone: Tamomoe delv @8.8.8.8 example.com CAA po'o le su'ega i dnsviz.net. Afai dig @8.8.8.8 example.com toe fo'i mai status: SERVFAIL ao dig +cd @8.8.8.8 example.com (+cd = Checking Disabled, le amanaiaina DNSSEC) toe faafoi lau tuatusi IP, ua motu lau filifili DNSSEC. Fa'ato'a ulufale i totonu o lau resitara fa'apitoa ma ave'ese le fa'aletonu DS faamaumau pe kopi le taimi nei DS tapula'a mai lau 'au DNS toaga.

Vaega 4: Fa'asao le Let's Encrypt tapula'a Tau (429 Too Many Requests) i le taimi o se ta'avale malosi¶

I le taimi o se faʻalavelave faʻalavelave, e masani ona toe amata e inisinia pusa pe taʻavale certbot fa'afia seia o'o ina teena e Let's Encrypt talosaga uma ma: - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168h0m0s - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many failed authorizations (5) recently

Taimi fa'atali e amata mai le 1 itula (mo fa'atagaga ua le manuia) i le 7 aso (168 itula) (mo le fa'atapula'a o tusi pasi e 5). Aua le fa'atali mo le 1 itula po'o le 7 aso a'o le'o i lalo lau nofoaga o gaosiga. E lua au fa'atonuga fa'atulafonoina fa'avavevave:

Ta'amilosaga A (sili ona lelei): Suia le ACME Certificate Authority i le ZeroSSL, Buypass, po'o le Google Trust Services ile 30 sekone¶

O le ACME protocol (RFC 8555) o se tulaga tatala. O su'esu'ega tetele uma ma faiga fa'aogaina e fa'atuatuaina ZeroSSL (Sectigo root), Buypass Go SSL (Norwegian CA), ma Google Trust Services (pki.goog) e tutusa lelei ma Let's Encrypt (ISRG Root X1). E leai se tasi o latou fa'asoa fa'atapula'a fua fa'atasi ma Let's Encrypt.

• Filifiliga 1: Fa'asalalau vave e ala i Certbot fa'aaoga le Buypass Go SSL (Leai se tala/EAB ki e mana'omia, 180-aso aoga): (Manatua: Buypass e lagolagoina le tele-domain certificates e oo atu i le 5 SANs, e ui lava e le o wildcard *.example.com tusipasi)

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://api.buypass.com/acme/directory" \
    -d example.com -d www.example.com \
    --email admin@example.com --agree-tos
  

• Filifiliga 2: Fa'asalalau vave e ala i acme.sh (lea e faaletonu i le ZeroSSL pe sui CA ma --server):

  # Using ZeroSSL:
  acme.sh --register-account -m admin@example.com --server zerossl
  acme.sh --issue -d example.com -d www.example.com -w /var/www/html --server zerossl
  

• Filifiliga 3: Fa'amatalaga e ala ile Google Trust Services (pki.goog) ACME lautele: I Google Cloud Console (po'o ala gcloud publicca external-account-keys create), fa'atupu se Fa'amauina Fa'amatalaga Fa'aola fua (EAB) ki i le 10 sekone ma tamoe:

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://dv.acme-v02.api.pki.goog/directory" \
    --eab-kid "YOUR_EAB_KEY_ID" \
    --eab-hmac-key "YOUR_EAB_HMAC_KEY" \
    -d example.com -d www.example.com
  

Ta'amilosaga B: Fa'aaloa le fa'agata o le Let's Encrypt "5 Tusi Faamaonia Fa'alua" e ala i le fa'aopoopoina o se isi igoa fa'aoga SAN.¶

Se'i e Encrypt le 168 itula fa'alua fa'atapula'a (too many certificates (5) already issued for this exact set of domains) o lo'o siaki le seti sa'o alafapeta o SAN hostname i luga o le tusipasi, ae o le aofa'iga fa'atapula'a o le Domain Registered o le 50 tusipasi i le vaiaso. 1. Fausia se DNS le afaina A faamaumauga e faasino i le server lava e tasi: tls-recovery-01.example.com -> <your_server_ip>. 2. Talosagaina le tusi faamaonia ma au ulua'i vaega faaopoopo le igoa talimalo fou:

sudo certbot certonly --nginx --cert-name example.com \
  -d example.com -d www.example.com -d tls-recovery-01.example.com

Vaega 5: Fa'aleleia male gau HTTP-01 lu'i (Port 80) poʻo le faʻaaogaina DNS-01 fa'amaoniga fa'afuase'i¶

O afea certbot renew toilalo ma Timeout during connect (likely firewall problem) pe Invalid response from http://example.com/.well-known/acme-challenge/...: 404 (po o 403), e le mafai e 'au'aunaga fa'amaonia a le CA ona o'o atu i lau fa'ailoga lu'i HTTP ile TCP port 80.

Aisea HTTP-01 faʻafuaseʻi ona malepe i luga o sapalai na galue i le 60 aso talu ai¶

1. Cloud Security Group / UFW / iptables tapuni le Taulaga 80: Na faamaaa e se tasi le pa puipui ina ia na o le uafu 443 (HTTPS), galo ai le RFC 8555 HTTP-01 faʻamaonia ** e amata i taimi uma i luga o le HTTP port 80 ** (e ui o le a mulimuli mai a 301 toe faasino i https:// i luga o le uafu 443).
2. ** IPv6 gau (AAAA) Fa'amaumauga**: O lau vaega o lo'o iai uma le IPv4 (A) faamaumauga ma se IPv6 (AAAA) faamaumauga. Tatou fa'aigoa ** e sili ona fiafia i le IPv6 (AAAA) muamua**. Afai e sese lau tuatusi IPv6, poloka e ip6tables, pe le saisaitia i Nginx (listen [::]:80;), taimi fa'amaonia e ui ina lelei le IPv4.
3. Nginx / Fa'asinoala Talosaga (React / Next.js / Django / Rails) fa'alavelave /.well-known/acme-challenge/: Lau server poloka i luga o le taulaga 80 sui o feoaiga uma (location / { proxy_pass http://localhost:3000; }) i se app pito i tua nai lo le tautua .well-known mai le disk.

Lua fa'aleleia vave mo gau HTTP-01 fa'amaoniga¶

Fix 1: Faʻaopoopo se faʻamuamua maualuga-faʻamuamua /.well-known/acme-challenge/ poloka ile Nginx (Port 80)¶

Ia mautinoa lou port 80 poloka i totonu /etc/nginx/sites-enabled/ tautua ACME fa'ailoga sa'o mai /var/www/letsencrypt mua i ai return 301 https://... pe proxy_pass faatonuga:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

sudo mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
sudo nginx -t && sudo systemctl reload nginx
sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com

Fa'atonu 2: Ta'alo le Taulaga 80 ma 'upega tafa'ilagi atoa ma se tusi lesona DNS-01 (TXT) lu'i¶

Afai ua poloka le taulaga 80 e se ISP/firewall i luga po'o lau paleni uta e le mafai ona uia .well-known i le tele o pito pito i tua, faʻamaonia e ala ile DNS ile 2 minute:

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

dig +short TXT _acme-challenge.example.com @8.8.8.8

Vaega 6: Fa'amaonia le toe fa'afo'isia (Vaega Intermediate, OCSP Stapling, ma le CDN Purge)¶

O se mea sese masani pe a uma ona sui tusi fa'afuase'i o lo'o fa'apipi'i cert.pem (o le lautusi na'o) nai lo fullchain.pem (le pepa faʻamaonia + tusi faamaonia CA intermediate). Su'esu'e i luga o le komepiuta (Chrome, Firefox) e masani ona ufiufi se tusi pasi vaeluaga e misi e ala i le AIA (Authority Information Access) tulituliloaina po'o fa'apolokalame fa'alata, a'o curl, Python, OpenSSL, Android apps, ma Stripe/Twilio webhooks e le manuia vave unable to verify the first certificate (SSL certificate problem: unable to get local issuer certificate).

• Ia fa'amaonia ua auina atu e lau 'au'aunaga le filifili atoa Intermediate (fullchain.pem): tamoe:

  echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | grep -E "Verify return code|depth="
  

  E tatau ona e va'aia a itiiti mai lua tulaga (depth=0 lau vaega ma depth=1 le CA intermediate pei o Let's Encrypt E5/R11 pe ZeroSSL RSA Domain Secure Site CA) ma Verify return code: 0 (ok). Afai e te vaai Verify return code: 21 (unable to verify the first certificate), sui lau upega tafa'ilagi config mai cert.pem ia fullchain.pem.
• ** Faʻamama le OCSP Stapling cache i Nginx / Apache **: Afai ssl_stapling on; ua mafai, toe uta le upega tafailagi ma siaki openssl s_client -servername example.com -connect example.com:443 -status 2>/dev/null | grep -A 15 "OCSP response".
• ** Faʻatonu le mataʻituina o le faʻamutaina o le SSL (TCP i fafo + Prometheus blackbox_exporter)**: Aua ne'i fa'alagolago na'o i fa'amanatuga imeli (Let's Encrypt fa'agata fa'amanatu fa'amutaina imeli ile 2025). Mata'itu le uafu ola 443 socket fafo (probe_ssl_earliest_cert_expiry - time() < 86400 * 14) ma seti se siaki cron i aso taitasi sudo certbot renew --dry-run.

Numera fa'aitulagi o fa'alavelave fa'afuase'i ma fa'atonuga a le lala sooupu¶

E ui o se tusi pasi TLS ua mae'a e masani lava ona foia e vaega inisinia, o se tusi pasi e motusia faitotoa o le soifua maloloina, faʻalavelave faʻafuaseʻi webhooks, faʻamaoniga o teugatupe, poʻo atinaʻe lautele a le malo e mafai ona faʻaosoina faʻatonuga faʻalavelave faʻalavelave:

• Amerika ma Kanata:
• Saogalemu-Olaga / Falema'i / Ta'ita'i Ta'otoga: Telefoni 911 pe afai o le le manuia o le tusi pasi TLS e tipi ese ai le telemetry o tagata maʻi, faʻatonuina, poʻo fesoʻotaʻiga feʻaveaʻi faʻafuaseʻi.
• Saogalemu Sipi ma Atina'e Saogalemu Ofisa (CISA) (US): O ofisa feterale lautele i lalo o le CISA Binding Operational Directive (BOD) 18-01 ma le aufaipisinisi ogaoga o loʻo feagai ma le tuʻuina atu o tusi faamaonia e leʻi faʻatagaina (CA fetuutuunai poʻo le BGP/DNS hijacking) e tatau ona lipoti atu i 1-844-Say-CISA (1-844-729-2472) po o cisa.gov/report.
• Canadian Center for Cyber Security: Faafesoota'i 1-833-CYBER-88 (1-833-292-3788).
• ** Malo Tele**:
• Au'aunaga Fa'afuase'i: vili 999 pe a fa'aletonu le TLS e a'afia ai faiga fa'apitoa a le NHS po'o le saogalemu o le ola.
• ** National Cyber Security Center (NCSC)**: Afai e te mauaina se tusi faamaonia e le'i fa'atagaina na tu'uina atu mo lau vaega ile Tusi Fa'amaonia Malamalama (crt.sh) ogalaau o loʻo faʻaalia ai le faoa o DNS, lipoti e ala i ncsc.gov.uk.
• Iuni Europa:
• Au'aunaga Fa'afuase'i: vili 112 i totonu o setete uma o le EU.
• NIS2 Directive & eIDAS Qualified Website Authentication Certificates (QWACs): O vaega taua ma le taua i lalo o le NIS2 Directive o lo'o feagai ma se faaumiumi o le avanoa po'o le fa'aletonu ki PKI e tatau ona logoina a latou CSIRT a le atunu'u i totonu ole 24 itula.
• Ausetalia ma Niu Sila:
• Au'aunaga Fa'afuase'i: vili 000 i Ausetalia po o 111 i Niu Sila; fa'afeso'ota'i le ACSC (1300 CYBER1) mo fa'alavelave tetele.
• Initia ma Asia-Pasefika:
• Initia (CERT-In / Pule o Pulega Faamaonia CCA): vili 112 mo tali fa'afuase'i; lipoti atu le maliega a le PKI po'o le tele o aseta ua motusia i incident@cert-in.org.in i totonu ole 6 itula.

Fesili e fai soo¶

Aisea e le mafai ai e aʻu poʻo aʻu tagata faʻaoga ona kiliki "Advanced -> Faʻagasolo i le saite (le saogalemu)" i Chrome poʻo Safari i le taimi o lenei taʻavale?¶

A auina atu e lau vaega le Saogalemu-Felauaiga-Saogalemu (HSTS) Ulutala HTTP - po'o le fa'aogaina o se vaega pito i luga e pei o .dev, .app, .itulau, pe .faletupe e fa'amalo i totonu ole su'esu'ega HSTS Preload List - RFC 6797 mana'omia le su'esu'ega e fa'aogaina so'o se tusi pasi ua uma, saini e le tagata lava ia, po'o le le fetaui o se mea sese e le mafai ona toe fa'aleleia. E aveese ma le loto i ai e le su'esu'e le ki "Fa'agasolo pea" e taofia ai le au osofa'i a Man-in-the-Middle (MitM) mai le fa'a'ole'ole o tagata fa'aoga e kiliki i se tusi pasi fa'asese. A'o mafai e se tagata atia'e i luga o le komepiuta Chrome ona lolomi le fa'asologa o keyboard natia le saogalemu lenei tuusa'o i luga o le mata sese e pasi ai i le lotoifale mo le suʻega, e le mafai e tagata faʻaoga moni; e tatau ona e faʻapipiʻi se tusi faamaonia aoga i luga o le taulaga 443.

Let's Encrypt taofi le lafo atu o imeli lapata'iga e muta le taimi ma ua muta la'u tusipasi e aunoa ma se fa'asilasilaga - aisea na tupu ai lena mea?¶

Let's Encrypt fa'amuta aloa'ia lana tautua imeli fa'ailoa e muta i le ogatotonu o le 2025 e fa'aitiitia ai le fa'amauina o fa'amaumauga i luga a'e ma talu ai e tatau ona mata'ituina sa'o e le ACME seti fa'afouina le soifua maloloina. Ina ia puipuia le fa'ate'ia i le lumana'i, e tatau ona e mata'itūina le fa'ailoga taimi e muta ai le fa'atalofa lima a le TLS i luga o le feso'ota'iga e fa'aaoga ai se mata'itū i fafo (e pei o le Prometheus. blackbox_exporter, Uptime Kuma, Better Stack, poʻo le Datadog Synthetic TLS siaki) mataala ile 21 aso, 14 aso, ma le 7 aso muamua atu. leai Ina ua uma.

Aisea e lelei ai laʻu saite i Chrome ma Firefox i luga o laʻu komepiuta, ae le manuia i telefoni Android, curl, ma Stripe webhooks pe a uma ona ou faafou le tusi faamaonia?¶

Na e fa'atulagaina lau 'upega tafa'ilagi (ssl_certificate i Nginx poʻo SSLCertificateFile i Apache) e faasino i ai cert.pem (o le lautusi na'o) nai lo fullchain.pem (le pepa tusi fa'apipi'i fa'atasi ma le tusipasi Intermediate CA). O masini su'esu'e e pei o Chrome ma Firefox e otometi lava ona la'u mai tusi pasi o lo'o misi i tua e fa'aaoga ai le Avanoa Fa'amatalaga Pulega (AIA) URL i totonu o lau pepa faʻamaonia, natia le faʻaogaina sese o lau server. Peitai, pipi'i, OpenSSL, Android's system trust verifier, Python, ma webhook servers e le faia le tuliloaina o AIA ma vave teena le sootaga ma le mafai ona maua se tusipasi fa'alotoifale. Faasino lau config i fullchain.pem ma toe uta lau server.

E fa'afefea ona ou siaki pe na tu'uina mai e se tagata ta'avale po'o se pule fa'atauva'a se tusi fa'amaonia SSL e le'i fa'atagaina mo la'u vaega?¶

So'o se Pulega Tusipasi fa'atuatuaina e mana'omia le fa'amauina o tusi pasi uma e tu'uina atu i tagata lautele Fa'ailoga Fa'amaonia (CT). (RFC 6962) a'o le'i fa'atuatuaina e tagata su'esu'e. Tatala https://crt.sh/?q=%25.yourdomain.com po'o le Cloudflare's Certificate Transparency Monitor e va'ai i tusi pasi uma na tu'uina atu mo lau vaega ma ona subdomains. Afai e te vaʻai i se tusi faamaonia na tuʻuina atu e se CA e te le masani ai e te leʻi faʻatagaina, siaki vave lau resitala DNS ma le sone DNS faʻatagaina mo suiga e le faʻatagaina, soloia le tusi faʻamaonia ma le CA tuʻuina atu, ma loka lau DNS i CAA faamaumauga (`0 issue "letsencrypt.org"`).

Ae a pe a fai o la'u fuifui Kubernetes cert-manager ua le mafai ona faafou le matou tusipasi Ingress ma ua pipii le Poloaiga i totonu Pending?¶

Taufetuli kubectl maua oka, lu'i -A ona sosoo ai lea kubectl faamatala lu'i -n . I le 90 pasene o Kubernetes pule tusipasi motusia, le cm-acme-http-solver-* o lo'o fa'agasolo le pod le tumau, ae a le o le (1) o le Ingress resource o lo'o i ai se fa'amatalaga tuai o le vasega o le ingress o lea e le mafai ai ona fa'apipi'i le ala fofo i lau paleni uta, (2) a Kubernetes NetworkPolicy o lo'o polokaina le felauaiga i totonu o le fofō i luga o le taulaga 8089, po'o le (3) o se fa'aulu-ulu NAT / split-horizon DNS mataupu e taofia pule tusipasiO le su'esu'ega a le tagata lava ia mai le o'o atu i lau IP faapaleni uta lautele (e mafai ona fa'aleleia e ala i le pasi --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53 i le pule tusipasi deployment args).

E mafai ona ou kopiina la'u /etc/letsencrypt/ faila i se server fou i le taimi o se fa'alavelave fa'afuase'i nai lo le toe tu'uina atu?¶

Ioe. Afai na mate lau 'au'aunaga muamua ma o lo'o e alu atu i se 'au'aunaga fou a'o fa'atapula'aina e le Let's Encrypt, fa'asao symlinks pe a kopiina. /etc/letsencrypt/ faaaogaina tar -czpf letsencrypt_backup.tar.gz /etc/letsencrypt (aua le faʻaaogaina manino scp -r, lea e liliu ai symlinks i totonu /etc/letsencrypt/live/ i totonu o faila faila fa'alua ma motusia fa'afouga i le lumana'i). Aveese lena fa'amaumauga i luga o le server fou (`sudo tar -xzpf letsencrypt_backup.tar.gz -C /`), faasino Nginx/Apache i `/etc/letsencrypt/live/domain/fullchain.pem`, ma o lau tusi faamaonia o iai o le a galue vave i luga o le tuatusi IP fou.

Taiala fa'atatau¶

• O le faoa o igoa ole domain, DNS ua mae'a, ma le fa'aaogaina o le upega tafa'ilagi
• Tisiki server 100% tumu (0 bytes leai se totogi): faʻamaumauga ma le toe faʻaleleia o avanoa
• Google Workspace poʻo Microsoft 365 custom domain admin loka ma DNS TXT laveai
• Fa'alavelave fa'afeiloa'i i luga o le upega tafa'ilagi, femalagaiga, ma le toe fa'aleleia o fa'amaumauga
• DNS faomea, ISP router WAN toe fetuutuunai, ma le faatagataotauaina spoofing faitotoa
• Numera o fa'alavelave fa'afuase'i ile atunu'u

Punavai ma ta'iala aloa'ia¶

• Vaega Fa'ainisinia Initaneti (IETF): RFC 8555 (Automatic Certificate Management Environment / ACME), RFC 8659 (DNS Certification Authority Authorization / CAA), ma le RFC 6797 (HTTP Strict Transport Security / HSTS).
• National Institute of Standards and Technology (NIST) (United States): * Faʻasalalauga Faʻapitoa 800-52 Rev. 2: Taʻiala mo le Filifiliga, Faʻatulagaina, ma le Faʻaaogaina o Faʻasalalauga Layer Security (TLS) Faʻatinoga & SP 1800-16: Puipuiga o Fefaʻatauaiga i luga ole laiga: TLS Server Certificate Management *.
• Vaega Su'esu'e Saogalemu Initaneti (ISRG / Tatou Fa'aigoaina Fa'amaumauga Aloaia): * Fa'amatalaga Fa'atapula'a Fa'atatau, Tulaga Fa'alua Tusi Fa'amaonia, ma Fa'afitauli Fa'afitauli a le ACME*.
• Saogalemu i luga ole Initaneti ma Ofisa Puipuiga o Atina'e (CISA) (United States): Binding Operational Directive 18-01: Enhance Email and Web Security (HTTPS and HSTS Implementation Guidance).
• National Cyber ​​Security Center (NCSC) (United Kingdom): * Faʻaaogaina o le TLS e Puipuia Faʻamatalaga Atoatoa i Femalagaaʻiga ma Tusi Faamaonia Faʻamatalaga Mataʻituina Faʻamatalaga *.