Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Delete AIA cache on uninstall #87

Open
JeremyRand opened this issue Aug 1, 2021 · 0 comments
Open

Delete AIA cache on uninstall #87

JeremyRand opened this issue Aug 1, 2021 · 0 comments

Comments

@JeremyRand
Copy link
Member

Imagine the following chain of events:

  1. Phineas installs ncdns-nsis, with TLS enabled.
  2. Phineas visits a .bit domain with TLS, but gets an error due to the system date/time being wrong. CryptoAPI caches the AIA URL's.
  3. Phineas uninstalls and reinstalls ncdns-nsis, and fixes his date/time. By reinstalling ncdns-nsis, Phineas has rotated his Encaya keys.
  4. Phineas now tries to visit the same .bit domain again.

Unfortunately, this results in an inconsistent state between the CryptoAPI AIA cache (which contains a Domain AIA Parent CA that is signed by the old Encaya key) and Encaya (which contains a .bit TLD CA with the new Encaya key). The result is that CryptoAPI will think the ECDSA signature on the Domain AIA Parent CA certificate is invalid.

In theory, the AIA cache will expire and this will fix itself, but the AIA cache does not appear to expire very quickly -- I waited an hour or so and it didn't help. However, we can flush the cache instantly by running this:

certutil -URLcache http://aia.x--nmc.bit/ delete

We should probably make ncdns-nsis run this command as part of the Encaya uninstallation routine. That ensures that whatever AIA cache mess was left by Encaya is gone when Namecoin is uninstalled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant