boulder
boulder copied to clipboard
Send email notifications when a new account issues for an FQDN you've previously issued for
If account A regularly issues for FQDN N, and then account B issues for N, we'd like for account A to get an email notification. Most of the time this type of issuance is innocuous (domain transfers, building a new web server, switching to a hosting provider), but on a rare occasion this may provide someone the notification they need that their DNS or other infrastructure is compromised and being used to issue certificates.
Considerations:
- A small number of integrations create a new account for every issuance. We shouldn't send emails to accounts that have only issued for a name once.
- If there are many different accounts that all issue for the same name, we should have some mechanism in place so we don't have to send N emails with each new issuance... that would produce N*N/2 total email sends!
- We should improve our unsubscribe infrastructure so people can unsubscribe from these emails separately from expiration emails.
This feature sounds like it could be related to, or at least share a lot of code with, CAA iodef
support.