search

FGasper / p5-Net-ACME2

CPAN’s Net::ACME2
Other
3 stars 7 forks source link

Net-ACME2-HTTP_Tiny requests escalated dramatically when DST Root CA X3 expired #11

Closed ezekiel closed 2 years ago

ezekiel commented 2 years ago

Hi,

When DST Root CA X3 expired, requests from this client against the Let's Encrypt API escalated dramatically ( especially against authorization endpoints like /acme/authz-v3 ). image

In response, we have had to apply a very strict ratelimit, which we hope to revert as soon as the problematic behavior in Net::ACME2 has been identified and fixed.

FGasper commented 2 years ago

@ezekiel Thank you for the heads-up … heh, maybe that explains why I was getting 429s against /directory. :)

Is this a bug report against Net::ACME2, or just an FYI?

ezekiel commented 2 years ago

This is a bug report against Net::ACME2. I would like to help dig through chain validation and/or retry-with-backoff code, but figured better to get the report up quickly.

FGasper commented 2 years ago

chain validation and/or retry-with-backoff code

There isn’t any. Net::ACME2 is just an interface to ACME; it doesn’t implement anything more.

FGasper commented 2 years ago

cPanel is a user of this module, though; their boxes are a likely source of the uptick in requests.

FGasper commented 2 years ago

I’m emailing you.

ezekiel commented 2 years ago

Ah! That's an information upgrade for me - okay, thank you.

FGasper commented 2 years ago

I‘m going to close this for now.