{"id":12143,"date":"2020-03-03T16:32:11","date_gmt":"2020-03-03T21:32:11","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12143"},"modified":"2020-09-16T11:06:42","modified_gmt":"2020-09-16T15:06:42","slug":"lets-encrypt-to-revoke-3-million-ssl-certificates-on-march-4","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/lets-encrypt-to-revoke-3-million-ssl-certificates-on-march-4\/","title":{"rendered":"Let\u2019s Encrypt to Revoke 3 Million SSL Certificates on March 4"},"content":{"rendered":"\n

The world\u2019s leading free SSL provider announces that millions of\ncertificates are being revoked due to a bug they discovered days ago \u2014 giving subscribers\npotentially only hours to respond<\/h2>\n\n\n\n

Let\u2019s Encrypt, the world\u2019s biggest free SSL certificate authority (CA), announced to subscribers today (March 3) that they discovered a bug<\/a> that\u2019s causing them to revoke more than 3 million SSL\/TLS certificates by tomorrow, March 4 (at 00:00 UTC at the earliest). The trouble? Their announcement barely gives their users time to react.<\/p>\n\n\n\n

Due to the short revocation timeline that\u2019s stipulated by\nthe CA\/B Forum\u2019s baseline requirements, it means that Let\u2019s Encrypt had to rush\nto inform users about the revocation that\u2019ll be completed in less than 24\nhours. That means, unfortunately for LE certificate subscribers \u2014 people like\nyou, possibly \u2014 that your certificates may be affected and you may not know it.\n<\/p>\n\n\n\n

But why do they need to revoke these certificates at all? What\ndoes this mean for Let\u2019s Encrypt SSL subscribers? And what should you do if\nyou\u2019re one of those whose certificates are affected?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

What we’re hashing out…<\/p>

<\/polyline><\/svg><\/div>
  1. The world\u2019s leading free SSL provider announces that millions of\ncertificates are being revoked due to a bug they discovered days ago \u2014 giving subscribers\npotentially only hours to respond<\/a>
      <\/ol><\/li>
    1. What\u2019s the Situation with Let\u2019s Encrypt\u2019s Mass Revocation?<\/a>
        <\/ol><\/li>
      1. Why CAA Records Matter in the Certificate Issuance Process<\/a>
          <\/ol><\/li>
        1. Let\u2019s Encrypt Appeals for Exemption<\/a>
            <\/ol><\/li>
          1. Why a Let\u2019s Encrypt Revocation is Such a Big Deal<\/a>
            1. Not Everyone Knows That They May Be Affected<\/a>
                <\/ol><\/li>
              1. LE Rate Limits Hamper Users <\/a>
                  <\/ol><\/li>
                1. LE Subscribers Have Limited Visibility and Support<\/a>
                    <\/ol><\/li><\/ol><\/li>
                  1. What You Should Do If You\u2019re Using Any Let\u2019s Encrypt Certificates<\/a>
                    1. Step One: Check Your Certificates<\/a>
                        <\/ol><\/li>
                      1. Renew Your Certificates<\/a>
                          <\/ol><\/li><\/ol><\/li>
                        1. Final Thoughts<\/a>
                            <\/ol><\/li><\/ol><\/div>\n\n\n\n

                            What\u2019s the Situation with Let\u2019s Encrypt\u2019s Mass Revocation?<\/h2>\n\n\n\n
                            \"Graphic:<\/figure><\/div>\n\n\n\n

                            On Feb. 29, Let\u2019s Encrypt discovered a bug in their code was allowing the issuance of SSL\/TLS certificates that didn\u2019t go through proper domain record checks. This is resulting in a mass revocation of 3,048,289 valid SSL certificates out of their 116 million. That\u2019s 2.6% of all of their existing certificates! <\/p>\n\n\n<\/span><\/span>\n\n\n\n

                            So, if you don\u2019t renew your affected SSL\/TLS certificate(s) before the March 4 revocation deadline, you\u2019re going to find yourself in hot water. If Let\u2019s Encrypt revokes your cert before you have a chance to renew, your website users will see ugly security warnings that may drive them away from your website. These messages will continue to display until you renew your certificate!<\/p>\n\n\n\n

                            Jacob Hoffman-Andrews, lead developer for Let\u2019s Encrypt, posted on Mozilla\u2019s Bugzilla web forum<\/a> to explain the issue more in depth: <\/p>\n\n\n\n

                            On 2020-02-29 UTC, Let\u2019s Encrypt found a bug in our CAA code. Our CA software, Boulder, checks for CAA records at the same time it validates a subscriber\u2019s control of a domain name. Most subscribers issue a certificate immediately after domain control validation, but we consider a validation good for 30 days. That means in some cases we need to check CAA records a second time, just before issuance. Specifically, we have to check CAA within 8 hours prior to issuance (per BRs \u00a73.2.2.8), so any domain name that was validated more than 8 hours ago requires rechecking.<\/em> <\/p>

                            The bug: when a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times. What this means in practice is that if a subscriber validated a domain name at time X, and the CAA records for that domain at time X allowed Let\u2019s Encrypt issuance, that subscriber would be able to issue a certificate containing that domain name until X+30 days, even if someone later installed CAA records on that domain name that prohibit issuance by Let\u2019s Encrypt.\u201d<\/em> <\/p><\/blockquote>\n\n\n\n

                            So, what does all of this mean? What we\u2019re talking about here\nrelates to checks of certificate authority authorization (CAA) records.  <\/p>\n\n\n\n

                            Why CAA Records Matter in the Certificate Issuance Process<\/h2>\n\n\n\n

                            A CAA record is a resource that was created to help prevent fraudulent SSL\/TLS certificates from being issued for any domain and to help strengthen the PKI ecosystem. It\u2019s a DNS record on the domain that every issuing CA is required to<\/a> check. It\u2019s an easy way for a CA to know whether they\u2019re authorized to issue a certificate for a domain: <\/p>\n\n\n\n