Try for Free
Advertisement
  1. SEJ
  2.  » 
  3. News

Let’s Encrypt Revoking Millions of SSL Certificates

Let’s Encrypt Revoking Millions of SSL Certificates
Advertisement

Let’s Encrypt announced that a bug affecting over 3 million websites using their Let’s Encrypt security certificate. Let’s Encrypt is revoking over 3 million affected certificates on March 4, 2020.

Sites with revoked certificates may begin showing insecure icons in browser, which may result in less traffic and less sales. Affected site publishers will have to reapply for a new certificate in order to regain secure status.

Let’s Encrypt Announcement of Bug

Let’s Encrypt warned customers that it will revoke security certificates on March 4, 2020:

“Due to the 2020.02.29 CAA Rechecking Bug 5.6k, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates.”

Certificates will begin being revoked at 3 PM EST.

Who is Affected by SSL Certificate Bug?

This bug affects 2.6% of publishers who rely on Let’s Encrypt for their security certificate. That equals over three million websites.

Emails have been sent to affected publishers.

If you have not received an email it’s still possible that you have been affected because the notice may not have been delivered for all the usual reasons (check your spam folder).

There is a way to check. The following web page has a diagnostic tool to identify if yours is one of the affected sites:

https://checkhost.unboundtest.com

Alternatively, you can download a list of all affected URLs here.

If your site is affected, this is the warning the tool will give to you:

lets encrypt bugThis is the warning message you’ll receive if your Let’s Encrypt security certificate is affected and needs renewing.

According to the Let’s Encrypt announcement:

Advertisement
Continue Reading Below

“The bug: when a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times.

What this means in practice is that if a subscriber validated a domain name at time X, and the CAA records for that domain at time X allowed Let’s Encrypt issuance, that subscriber would be able to issue a certificate containing that domain name until X+30 days, even if someone later installed CAA records on that domain name that prohibit issuance by Let’s Encrypt.

We confirmed the bug at 2020-02-29 03:08 UTC, and halted issuance at 03:10. We deployed a fix at 05:22 UTC and then re-enabled issuance.”

Read the announcement blog post here:

https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591

Advertisement
Continue Reading Below

Read the announcement of certificate revocations here:

https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864

More Resources

CategoryNews
ADVERTISEMENT

Subscribe to SEJ

Get our daily newsletter from SEJ's Founder Loren Baker about the latest news in the industry!

Ebook

Roger Montti

Roger Montti is a search marketer with 20 years experience. He provides site audits, phone consultations and content and link ... [Read full bio]

ADVERTISEMENT
Advertisement
Read the Next Article
Read the Next