letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use 7 hours as CAA recheck window. (#4845) 

For all things compliance-related, we should aim to be well within
the requirement rather than right at the edge.
This commit is contained in:
Jacob Hoffman-Andrews 2020-06-04 18:40:30 -07:00 committed by GitHub
parent 6f4966cc0f
commit d0d22cb902
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ra/ra.go
View File

@ -766,13 +766,13 @@ func (ra *RegistrationAuthorityImpl) checkAuthorizationsCAA(
var recheckAuthzs []*core.Authorization
// Per Baseline Requirements, CAA must be checked within 8 hours of issuance.
// CAA is checked when an authorization is validated, so as long as that was
// less than 8 hours ago, we're fine. If it was more than 8 hours ago
// we have to recheck. Since we don't record the validation time for
// less than 8 hours ago, we're fine. We recheck if that was more than 7 hours
// ago, to be on the safe side. Since we don't record the validation time for
// authorizations, we instead look at the expiration time and subtract out the
// expected authorization lifetime. Note: If we adjust the authorization
// lifetime in the future we will need to tweak this correspondingly so it
// works correctly during the switchover.
caaRecheckTime := now.Add(ra.authorizationLifetime).Add(-8 * time.Hour)
caaRecheckTime := now.Add(ra.authorizationLifetime).Add(-7 * time.Hour)
for _, name := range names {
authz := authzs[name]
if authz == nil {