boulder icon indicating copy to clipboard operation
boulder copied to clipboard

Send email notifications when a new account issues for an FQDN you've previously issued for

Open jsha opened this issue 3 years ago • 1 comments

If account A regularly issues for FQDN N, and then account B issues for N, we'd like for account A to get an email notification. Most of the time this type of issuance is innocuous (domain transfers, building a new web server, switching to a hosting provider), but on a rare occasion this may provide someone the notification they need that their DNS or other infrastructure is compromised and being used to issue certificates.

Considerations:

  • A small number of integrations create a new account for every issuance. We shouldn't send emails to accounts that have only issued for a name once.
  • If there are many different accounts that all issue for the same name, we should have some mechanism in place so we don't have to send N emails with each new issuance... that would produce N*N/2 total email sends!
  • We should improve our unsubscribe infrastructure so people can unsubscribe from these emails separately from expiration emails.

jsha avatar Oct 08 '21 22:10 jsha

This feature sounds like it could be related to, or at least share a lot of code with, CAA iodef support.

jprenken avatar Oct 09 '21 00:10 jprenken