Certs on site revoked? #15

chrisweeksnz · 2025-03-25T01:29:08Z

chrisweeksnz
Mar 25, 2025

Hi All,

There seems to be a disparity between the certs used to host traefik.me and the wildcard certs available to download.

Is it possible to get the wildcard certs refreshed with the current versions?

Many thanks for any help in advance!

Wildcard cert that appears to be revoked

Command:

echo | openssl s_client -connect traefik.traefik.me:443 2>/dev/null | openssl x509 -noout -text

Output:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:f6:93:96:f1:71:a1:79:7a:0e:c6:24:73:74:c9:0a:9d:f7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C=US, O=Let's Encrypt, CN=E5
        Validity
            Not Before: Mar 10 06:46:03 2025 GMT
            Not After : Jun  8 06:46:02 2025 GMT
        Subject: CN=traefik.me
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:8f:3c:75:af:fa:4f:71:78:8d:a7:1e:ee:6e:db:
                    7f:a1:0d:b6:39:89:cc:e2:24:f4:f1:9e:92:ff:f5:
                    95:60:4f:42:f4:37:c4:55:4e:f0:96:5a:af:41:83:
                    0b:82:19:4d:d9:d1:40:0f:9f:7e:e3:02:0a:5c:36:
                    de:be:ff:2b:57
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                F7:C5:84:1E:66:D8:CA:7F:27:BB:A7:3B:4B:F3:20:60:C9:A6:4C:A1
            X509v3 Authority Key Identifier:
                9F:2B:5F:CF:3C:21:4F:9D:04:B7:ED:2B:2C:C4:C6:70:8B:D2:D7:0D
            Authority Information Access:
                OCSP - URI:http://e5.o.lencr.org
                CA Issuers - URI:http://e5.i.lencr.org/
            X509v3 Subject Alternative Name:
                DNS:*.traefik.me, DNS:traefik.me
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : CC:FB:0F:6A:85:71:09:65:FE:95:9B:53:CE:E9:B2:7C:
                                22:E9:85:5C:0D:97:8D:B6:A9:7E:54:C0:FE:4C:0D:B0
                    Timestamp : Mar 10 07:44:33.742 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:94:BC:1B:99:F8:88:8C:F1:08:C4:82:
                                56:AA:3F:8A:24:C7:51:3A:6B:76:74:F3:7D:FA:FB:60:
                                7B:4E:56:18:F5:02:20:63:C7:D2:17:CE:B6:B3:12:5F:
                                CA:55:D1:8F:0A:FD:81:D2:FF:90:BE:9A:49:A2:CB:F5:
                                98:E9:77:8A:C2:61:FE
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : E0:92:B3:FC:0C:1D:C8:E7:68:36:1F:DE:61:B9:96:4D:
                                0A:52:78:19:8A:72:D6:72:C4:B0:4D:A5:6D:6F:54:04
                    Timestamp : Mar 10 07:44:33.922 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:C3:46:F7:F3:B1:0B:61:8E:71:B9:0A:
                                B8:C6:36:D3:1E:70:89:C0:FD:56:3D:8A:79:00:50:FD:
                                86:32:26:F9:8D:02:20:2A:B7:AC:0E:DD:5E:7B:F4:E9:
                                19:B7:AC:CA:E0:60:FD:F5:68:E0:DE:5A:B3:4A:4D:A1:
                                0D:4A:AF:2C:DE:08:92
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:66:02:31:00:d6:4a:ce:19:7c:c7:95:8a:32:e1:ca:ec:6e:
        58:3d:71:94:38:3d:3e:a1:c4:03:90:7d:72:2e:d7:b2:b0:a0:
        60:9b:6a:98:b1:b4:4d:26:3f:26:c7:a4:e3:0c:c5:be:f5:02:
        31:00:9e:63:f0:b3:36:3a:0a:f7:95:03:5d:73:8d:80:01:64:
        8b:f4:5a:dc:ee:6b:fe:47:15:a6:b6:fb:1d:b7:5d:4e:a7:67:
        be:7c:6e:a7:fe:ae:30:a4:8f:76:9b:76:fa:ab

Cert used by server appears to be valid, but not using the wildcard cert...

Command:

echo | openssl s_client -connect traefik.me:443 2>/dev/null | openssl x509 -noout -text

Output:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:ff:dd:8c:b1:ce:96:c7:fb:57:4f:1e:e7:4d:7b:a7:5f:2c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C=US, O=Let's Encrypt, CN=E6
        Validity
            Not Before: Mar 12 20:04:06 2025 GMT
            Not After : Jun 10 20:04:05 2025 GMT
        Subject: CN=traefik.me
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:46:14:27:bc:b5:ee:3c:95:6f:11:dc:9d:6f:4c:
                    ea:32:f4:7c:7f:83:18:52:52:16:08:cc:56:42:7c:
                    68:fa:e8:47:dc:0c:ac:d1:10:4d:04:ba:61:1e:6f:
                    27:ce:43:b1:c3:25:7e:c4:12:60:b7:cb:68:60:a3:
                    5b:63:a0:42:4d
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                C5:CC:AF:76:64:12:32:5F:28:84:9E:BF:9E:66:05:36:22:10:E2:25
            X509v3 Authority Key Identifier:
                93:27:46:98:03:A9:51:68:8E:98:D6:C4:42:48:DB:23:BF:58:94:D2
            Authority Information Access:
                OCSP - URI:http://e6.o.lencr.org
                CA Issuers - URI:http://e6.i.lencr.org/
            X509v3 Subject Alternative Name:
                DNS:traefik.me
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : CC:FB:0F:6A:85:71:09:65:FE:95:9B:53:CE:E9:B2:7C:
                                22:E9:85:5C:0D:97:8D:B6:A9:7E:54:C0:FE:4C:0D:B0
                    Timestamp : Mar 12 21:02:36.480 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:0D:79:64:3C:0F:D6:0C:BF:96:82:AB:5A:
                                2F:1A:7F:F4:29:56:32:92:5F:2C:B3:12:F8:1D:03:8C:
                                79:BC:E6:DF:02:21:00:AE:A7:19:45:82:DA:F9:BE:92:
                                E5:B8:A0:7A:CA:BD:C8:F9:59:29:54:DA:57:75:0A:22:
                                6A:F4:C1:5A:F4:CE:3B
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : DE:85:81:D7:50:24:7C:6B:CD:CB:AF:56:37:C5:E7:81:
                                C6:4C:E4:6E:D6:17:63:9F:8F:34:A7:26:C9:E2:BD:37
                    Timestamp : Mar 12 21:02:36.232 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:08:90:B1:7B:DD:6E:2D:30:E4:D0:DD:DF:
                                F6:14:67:3B:CE:D7:C6:9F:5E:29:72:5C:3D:62:76:30:
                                E8:4E:83:81:02:21:00:AA:88:AE:90:A6:8E:B3:C6:5A:
                                81:33:96:D9:34:7C:33:4E:9F:F2:FF:BE:9B:9D:4F:7A:
                                A8:2C:5E:B7:37:B3:FE
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:66:02:31:00:88:ce:fb:4e:5c:d7:1b:52:4b:6d:63:bf:ab:
        32:53:fa:00:85:a2:48:10:52:60:c5:ed:1a:7b:0a:2d:4d:63:
        49:ed:33:78:d2:e1:54:f9:44:66:0b:e4:ad:86:9d:2b:9d:02:
        31:00:b1:29:77:8a:95:93:a5:ad:d8:26:39:8e:89:89:9c:87:
        b5:97:cf:f1:73:a6:b4:f6:fd:9c:09:14:bd:ba:49:37:c5:e1:
        6f:71:18:79:3b:a2:e5:de:d9:6d:ae:43:50:34

pyrou · 2025-03-25T08:03:49Z

pyrou
Mar 25, 2025
Maintainer

This follow @Bradatletsencrypt revokation, see his message in #14

While I am not entirely sure that he comes legitimately from Let's Encrypt Team, and I'm not even sure whether I need to care about the "CA/Browser Forum Baseline Requirements" he mentioned, I must admit that I have to comply with the Let's Encrypt Subscriber Agreement, which clearly states :

You warrant to ISRG and the public-at-large that You have taken, and You agree that at
all times You will take, all appropriate, reasonable, and necessary steps to maintain control
of, secure, properly protect and keep secret and confidential the Private Key corresponding
to the Public Key in Your Certificate (and any associated activation data or device, e.g.
password or token)

I suggest using https://github.com/FiloSottile/mkcert as an alternative

I'll keep maintaining traefik.me service as a DNS resolver.

0 replies

tacone · 2025-04-03T21:10:06Z

tacone
Apr 3, 2025

Such a shame! So sorry for that, I was such a happy user for my local development. Wish you the best, your service has been great for a long time. Thank you so much!

I have to note, by the way, that such certificates still work on my (probably outdated) Chromium browser, it only Firefox that fails for now.

Good luck with your next projects!

0 replies

QuentinDouarre · 2025-04-27T16:07:08Z

QuentinDouarre
Apr 27, 2025

Is it possible to switch to another certification authority?
For example, Gandi offers wildcard certificates for very little money.
I think it's possible to fund the service through donations.

https://www.gandi.net/en/certificates/p/ssl-certificate-wildcard

1 reply

pyrou May 16, 2025
Maintainer

Gandi has same restrictions https://docs.gandi.net/en/ssl/documents/legal_documents.html

But feel free to sponsor server hosting ❤️ https://github.com/sponsors/pyrou

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Certs on site revoked? #15

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

Certs on site revoked? #15

Uh oh!

Uh oh!

chrisweeksnz Mar 25, 2025

Replies: 3 comments · 1 reply

Uh oh!

Uh oh!

pyrou Mar 25, 2025 Maintainer

Uh oh!

tacone Apr 3, 2025

Uh oh!

QuentinDouarre Apr 27, 2025

Uh oh!

Uh oh!

pyrou May 16, 2025 Maintainer

chrisweeksnz
Mar 25, 2025

Replies: 3 comments 1 reply

pyrou
Mar 25, 2025
Maintainer

tacone
Apr 3, 2025

QuentinDouarre
Apr 27, 2025

pyrou May 16, 2025
Maintainer