On Sun, Aug 24, 2025 at 03:56:06AM +1000, Viktor Dukhovni wrote:
> https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html
By this time all certificates issued by R10–R14 and E5–E9 (as well as
all previously retired CAs) have expired, and even the ISRG X1 and ISRG
X2 roots have now been replaced. Publishing TLSA records matching the
retired CAs no longer makes sense (is unnecessary bloat in your DNS data
and a security exposure should their keys be compromised).
Therefore, all the below DANE-TA(2) TLSA records should be dropped from
all TLSA RRsets (some Cert(0) selectors appear multiple for the same CA
because there are multiple versions of that intermediate CA's
certificate cross-signed by different issuers, ...).
- ISRG X1 (outdated root, replaced by ISRG YR):
2 1 1 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3
2 1 2
86db73fc5893c3ea76db8e7d72dc8fb568d71ca8d7cbf75ac0660221ff39f8ebf7f8de906a45be19e9b743f24eda845dc3bdf36d095c237400caea9ec0a2f5dd
2 0 1 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
2 0 2
3b40f27e828323f5b91f8909883a78a21c86551761f27b38029faaec14af5b7aa96fb9f9cc93ee201b5eb1d0fef17b290747e8b839d2e49a8f36c5ebf3c7c910
- ISRG X2 (outdated root, replaced by ISRG YE):
2 1 1 762195c225586ee6c0237456e2107dc54f1efc21f61a792ebd515913cce68332
2 1 2
2be19312b0b05d20d7edccf16eb355a8f6546bf7fa2b164ca0a20092dd542370b5cc1feedf2aa0c14b879cd017f123bb4251346bdbeec2480e19c91bc0488883
2 0 1 69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470
2 0 2
2bfbc06bdba0864bac09e5de0be19d67f5640b754c8f1442a6afb9ddbf8e03bd31063bfc01dc638f87ae8a8215ef37f94ce679291b050e44599d5fac564c6931
- R14:
2 1 2
3b4921b5fcb35dd660b8f8b5944d2506d389d4367981b38620b48a5d07334378590ba3f240aa7b64beea5d5489add8039a906e5ff4da3062789660e33e98f2d4
2 1 1 f1647a5ee3efac54c892e930584fe47979b7acd1c76c1271bca1c5076d869888
2 0 2
33f87b84ff94e27e6e1d9815608ea1396438188559f62f3e801466d0b8f7516d8f0bb8dda138d32e30f35f37e2fe44443cc9c2f3eadccde89de3047cdb8ce0c8
2 0 1 24d45aa9b8d6053d281f3842c8cc0c6c1af7ccdfd42dd5c12f6a74fa9323f7a2
- R13:
2 1 2
e19500a5a83e36d3529bcbcc2d07472f81d5e7c9a8032c00a98996f35f32123ed7093eeb789396c8603bfbe68ab6686e2b52c7baaa89043c74c5eed055dea95c
2 1 1 025490860b498ab73c6a12f27a49ad5fe230fafe3ac8f6112c9b7d0aad46941d
2 0 2
19bbb1ba2d0e3b6ec94b33a839d92e4115b89e400ee9a337c6098d4db95cfed2763226a6d85146dbd763526b79750f2340732c9be2b87d85d5570b46ea1cfdb2
2 0 1 d3b128216a843f8ef1321501f5df52a5df52939ee2c19297712cd3de4d419354
- R12:
2 1 2
661ba3b2ba5c26c64cfca723320b98984ae813d89ec8a6a0d4845d850197c2fa00add80db09b4785d8bd1ecfc518ee4ad6d0989a48e1325bfc1a99208e23538e
2 1 1 919c0df7a787b597ed056ace654b1de9c0387acf349f73734a4fd7b58cf612a4
2 0 2
a49a194c435cb8398246276d22d30f840080030025f3564f5feae43a0e6327268b37ea5e24eff31d77f0f1fd605c22ad0c346c71a003b31cdc723a5b12218569
2 0 1 131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec
- R11:
2 1 2
8854317b0a187b35956b5fd361f6101c86be4741107be8847ef4e3f48abf53200f65414c281fbdf08218ff14d15d6d1c5f2e9a1f09d7ce39d0ecf6adb654ea4a
2 1 1 6ddac18698f7f1f7e1c69b9bce420d974ac6f94ca8b2c761701623f99c767dc7
2 0 2
429fdae7d17a336879b0e6316ae6a5341ae5abb7ec7f7ed7eaad807228e346e7942378ef8cdd50cdd3b84670b0af274763d6e90d58eb3a483fb52d97f204b6da
2 0 1 591e9ce6c863d3a079e9fabe1478c7339a26b21269dde795211361024ae31a44
- R10:
2 1 2
86fb010ee652f162e22ba2ba48e45d3a19ee557ab8d2601aabd62c993a81417467bf9a8c50ba03f2315dfbb028478b22923bd87e3bbeeb02fc1f69104782eea4
2 1 1 2bbad93ab5c79279ec121507f272cbe0c6647a3aae52e22f388afab426b4adba
2 0 2
c5d1dd8b4ee8a17a351bb0fa40cc020e9b3364c59d9006badecc61bd5ca0c2b9729eab50da166633e4b0360ab914c42aa74cca861640e0abe5514430bb0daeaa
2 0 1 9d7c3f1aa6ad2b2ec0d5cf1e246f8d9ae6cbc9fd0755ad37bb974b1f2fb603f3
- E9:
2 1 2
61192edc98e0a4efddd151a2147b9f52128584e7f8e06d5e294888ba2214fdfea7f489032afbdace4a3d97420cbe9c36fac209ccf8ec9d0977dc4ef239434243
2 1 1 f1440a9b76e1e41e53a4cb461329bf6337b419726be513e42e19f1c691c5d4b2
2 0 2
019c1d843fdd2b050bd48302b6f8c94396cf95d33efe1b983901da28d50dfbcadf8da4e8d170fbddc79529d8877776b7589f4bd61b145c78e4f6c95146a72bf7
2 0 2
43becca2bc05dd9a1e86e139cdf8f37b52bdba7db512574b6fe467d98de5fdb5ea6bfc2deb49a25eda112ff15cb85edfd7740a1b082c50117aeea9ec14a33455
2 0 1 fde88f2d4f8913d3dc1664d5f8de51e07fe2abfed93b45acad5a29bfebaa23fb
2 0 1 4185df97806c2ba76f1d79823f112ffa639a49ccdc990908102067ab6412b886
- E8:
2 1 2
89d8f1d26d16e94600405c8585e40ad1ecde0023cd447e8b39fd90bc8b482c7bd68d963156e5037023b144ec4caa03af8213296f3a498f69dee691a95a92d722
2 1 1 885bf0572252c6741dc9a52f5044487fef2a93b811cdedfad7624cc283b7cdd5
2 0 2
3565cd99fb0bccf03019e4d2276ca5d7c913a3af1ad58a95a8cad181699364f22fb6dc6cc01e071847db3336ae9a122b968d31c5be9a4443e145daba2a1782c6
2 0 2
79fe4fa69b8f06e7f711acaebd1796cdd3e16f3d4f4091764821f67e78df27ff45461d2ce799e1de5365209ce2fd097c6ecea29b6bd4dce5a5b37f6e5235cfb5
2 0 1 83624fd338c8d9b023c18a67cb7a9c0519da43d11775b4c6cbdad45c3d997c52
2 0 1 ac1274542267f17b525535b5563bf731febb182533b46a82dc869cb64eb528c0
- E7:
2 1 2
7d779dd26d37ca5a72fd05f1b815a06078c8e09777697c651fbe012c8d2894e048fcfe24160ee1562602240b6bef44e00f2b7340c84546d6110842bbdeb484a7
2 1 1 cbbc559b44d524d6a132bdac672744da3407f12aae5d5f722c5f6c7913871c75
2 0 2
e18f3d6ccbc578f025c3c7c29ed7bffe1b8eef5b1f839c17298dcf218303d2a63e305f6c1f489691774a18bad836035e5af2de1fc42a3a26cfe9e530f92e3855
2 0 2
2b1929cf1b4b0eb35774fece4e9f27dff50091289342155a9bd8c3689fea65530d65a09f0e2d74c3b7ebc09f7d530c7f578bd16f87e6df30aff6656a859754e8
2 0 1 aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b
2 0 1 54715420224c5b65beed018dc3940d7338c577e322d5488f633d8c6a8fed61b2
- E6:
2 1 2
f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9
2 1 1 d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7
2 0 2
afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518
2 0 2
3a2375d29a3e66a3dd3c758cb9c056e8f5e66cf7bb49f6ac0760d27c2b41546ab757990194fc09853110978381e1feb5da22abc8037887a3a7c8a02c471c7c08
2 0 1 76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85
2 0 1 065ab7d2a050f947587121765d8d070c0e1330d5798faa42c2072749ed293762
- E5:
2 1 2
a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402
2 1 1 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
2 0 2
4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
2 0 2
4f104e5ec57f442f66e2fdab6147e63a153c2f558d8b73c398898c56b44d88792061b33cee2d8c2d10f456fc1a7382b1b3fd827293f7ebfb7bf51ef38ba356ba
2 0 1 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
2 0 1 e788d14b0436b5120bbee3f15c15badf08c1407fe72568a4f16f9151c380e1e3
- E2:
2 0 2
e8ec8405ab45605ae6e4a54efd6d626f663cb7e61a10d9a6a6a08b118e0d35763d0118e263a6db64516ca9f4e7f64fcd2b5dbf9e7a7ba265870606af26f4d855
2 0 1 bacde0463053ce1d62f8be74370bbae79d4fcaf19fc07643aef195e6a59bd578
2 1 2
23a30bd3b617652e97224e1faf673c4e09f1c197e4994274e676f2490893e9560d99f00a8859e399b2c65219ce2eb9b76784a0ec775ab4973a14fc1437ac7d9f
2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270
- E1:
2 0 2
0fc8bdb5b93d95bb016bb543bd74b859e4c18930964d59cfc305b93ef3212c0c20f3084ba98fbf7aac55d0d22c5b35566ed75bebe6d5a7c53ca1f949c45c3c8e
2 0 1 46494e30379059df18be52124305e606fc59070e5b21076ce113954b60517cda
2 1 2
3561540fbf182bce7749acc131b421e691f083569c053e78f20274714c5e801226ff6edb60641ddf70e71bd3a90dfe25ddd6464be78106b77dece4f6a3bff13d
2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10
- R4:
2 0 2
0f0b4dd77ee99d8ed5724da618b56017d08b757884796d087bf656e62d2717b5c913cb1e2eda07aacbfdbfdcb1ba5ba52114d54c000e05b0cb755256a61c0c37
2 0 1 1a07529a8b3f01d231dfad2abdf71899200bb65cd7e03c59fa82272533355b74
2 1 2
59a91d97d81980951d0ef3c6d849b31606af9ab2b0f7dcfac93a53ae3263eb8902c3b7c564f33ff496f2d07c750b1b6924968c243882af9e3532797eef596f27
2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03
- R3:
2 0 2
96c5793b2b57d8df5891c94015720960e0da4c2cf8ce1fc5707a0b46e5db8ce3761fb5fdb430f619d1579f13e80fbdd973ef6a024129ed039aa193273158fcad
2 0 1 67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
2 1 2
0f644c9a1dcb8c04be6b385a60dbe4fdf7e2b81e335c9ad8c7cd0abe2ff9e7e5bbfbb68b38dd0216f17808f48bdf6af8c6347659c1f41a9858032c31f436d12c
2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d
- X4:
2 0 2
964468a5c685f305aa5865c049d814770b844df2cf7645f9a4afaf42957e334bcf1f290babaafe020c4e9a68c5689d570e37f11114ffd676c95b17b3d768b932
2 0 2
74ddad9f8cdfa0fe6f6b70301b557a63a58b87fc2c17fae0f65e47d141226c062a74fa14861dc47a720bd8699b99091a06bd695cdde51222f837b9decfc270c5
2 0 1 a74b0c32b65b95fe2c4f8f098947a68b695033bed0b51dd8b984ecae89571bb6
2 0 1 5de9152bed31fa0515dd1fc746133f1327562ef72a84cf2d2403e748a604d0d4
2 1 2
a0f5d1333bc90bcea0b0b5f401160b6e7f28a1256bc5b5d65f04b06b0bb0c96270aa81d8e2726394d385bf3e9ee46eb4ab7548c782d5688cc16d0cdffefb8594
2 1 1 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b
- X3:
2 0 2
2e1e12dacb350e69317a7f37d769f46f16f437cf8d392319279c93515e5600baed3d3acd5dc83b673e8c60cf7fba0dce00a4d162a3b966a3ebf72487c376fca0
2 0 2
5ec5b0783c6e667e0965df772943a06326768de0f75dc0bd2fe378f02ccca7d56c987656174cbe158cc29ecd763f8bda3454332cc7d47fb934691409c5fb8686
2 0 1 25847d668eb4f04fdd40b12b6b0740c567da7d024308eb6c2c96fe41d9de218d
2 0 1 731d3d9cfaa061487a1d71445a42f67df0afca2a6c2d2f98ff7b3ce112b1f568
2 1 2
774fad8c9a6afc2bdb44faba8390d213ae592fb0d56c5dfab152284e334d7cd6abd05799236e7aa6266edf81907c60404c57ee54c10a3a82fcc2a9146629b140
2 1 1 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18
- X2:
2 0 2
0a46b8055caa27634ac8992ba5574e82aa6f9bd8079ced18ed561ba9062801281c26c06cf849f228d5dbc0d22e7487396723fc083f729ed40d25c519397623b3
2 0 2
070c005525584cb4ffc8ea0e6017f7cb27c995041701f60cb224293e6d398ca126ae11634e5bcc4103e28cf6c01d3bdd1fa2022b4cd9637ea69ab230f7605a37
2 0 1 ec0c6ca496a67a13342fec5221f68d4b3e53b1bc22f6e4bccc9c68f0415cdea4
2 0 1 e4eb54a7ffa552ef64d8e1ae338b69be909c29e6af57170a2f6f44df225e5a14
- X1:
2 0 2
95bed189bf575a88e7935f5967154f74908d3c32662c3f0b66af8522a6af22653fd693a39efe3639f5134466c46a16ebb7e849890fde84324de645ffe7e892b1
2 0 2
1968a36bc5fe322e7c24084ba65bbc52f28d02cc900050752adc48f56e7c1963d4d86d5cdacd1b0cb58ba2beca65714f9216af8f2d3d3d8812dde451b9514846
2 0 1 7fdce3bf4103c2684b3adbb5792884bd45c75094c217788863950346f79c90a3
2 0 1 bdee0d7c8f9c278f14ea9b6a4f90ed665a9f56db0a56b1cdda6765912f398a5e
- ISRG X1: expired 2024-09-30 cross-certificate from DST
2 0 1 6d99fb265eb1c5b3744765fcbc648f3cd8e1bffafdc4c2f99b9d47cf7ff1c24f
2 0 2
7adc2b5f11e5d12df7adb6cee95e04f7eca714404bff58849a360b910f3afbdc37235cdd99e33b4e82efeee16d598573a4e346e0a6bdc41f70b3603c6f4324fa
The correct sets of DANE-TA(2) TLSA records to use with Let's Encrypt
are either or both of:
- ECDSA (YE1-YE3):
2 1 1 6ebcefb4210b088654a38b03fea3d7d1c711b4fb1ddc363a45f9b1a4e53da01e
2 1 1 b3fb5d00e994cddf2cc9a4eea9f806bc5727e83cc0e4299bf956f2d524fe5376
2 1 1 a698a20824be04e47a1a33c4fa488731be92011f23a31e900e2ca26c9c2acfce
- RSA (YR1-YR3):
2 1 1 2e8307068b6db620e4a39d068b5dee5d6ef5788cbb2c0b6d23ead84fcc17178c
2 1 1 9d637b3d27a9e570d07607b9ccadb80a70915c7af72afce12841b1b1da825fd1
2 1 1 51aaa87d984b559ac69e929f888a022d832e089ff4dba0a412b5101bca4bc799
> # | CA
latest DANE survey stats show many MX hosts with outdated LE CA TLSA records:
# | CA
-----+---------
41 | X3 -- obsolete
1 | X4 -- obsolete
201 | R3 -- obsolete
62 | R4 -- obsolete
58 | E1 -- obsolete
46 | E2 -- obsolete
234 | E5 -- obsolete
246 | E6 -- obsolete
655 | E7 -- obsolete
658 | E8 -- obsolete
418 | E9 -- obsolete
241 | R10 -- obsolete
275 | R11 -- obsolete
538 | R12 -- obsolete
542 | R13 -- obsolete
416 | R14 -- obsolete
656 | ISRG X1 -- obsolete
966 | ISRG X2 -- obsolete
875 | YE1
926 | YE2
330 | YE3
423 | YR1
452 | YR2
258 | YR3
194 | IYR --
https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html#roots
684 | IYE --
https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html#roots
> If you still want to rely on TLSA records tied to the LE issuers, and
> haven't published the appropriate full set of hashes, better late than
> never. And of course you'll need to keep up with the news from LE and
> make additional timely changes in the future as the CAs used by LE
> evolve.
The above advice is still relevant.
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
