LetsEncrypt plans to revoke its certificates due to a software bug

The LetsEncrypt company, which offers free SSL certificates for encryption, is forced to revoke some certificates.

The issue is related to a software bug in the Boulder management software used for building the CA. Normally, the CAA DNS record check occurs simultaneously with domain ownership verification, and most subscribers receive a certificate immediately after the check, but the software developers made it so that the verification result is considered passed for the next 30 days. In some cases, a second check can be performed right before issuing the certificate, particularly needing a recheck of the CAA within 8 hours before issuance, so any domain verified before this period must be reverified.

What is the error? If a certification request includes N domains requiring a recheck of the CAA — Boulder would choose one of them and check it N times. As a result, there was a possibility of issuing a certificate even if a CAA record prohibiting the issuance of LetsEncrypt certificates was set later (within X+30 days).

To check certificates, the company has prepared an online tool, which will provide a detailed report.

Advanced users can do it all themselves using the following commands:

# проверка https
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :
# вариант проверки от @simpleadmin 
echo | openssl s_client -connect example.com:443 |& openssl x509 -noout -serial
# проверка почтового сервера, протокол SMTP
openssl s_client -connect example.com:25 -starttls smtp -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :
# проверка почтового сервера, протокол SMTP
openssl s_client -connect example.com:587 -starttls smtp -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :
# проверка почтового сервера, протокол IMAP
openssl s_client -connect example.com:143 -starttls imap -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :
# проверка почтового сервера, протокол IMAP
openssl s_client -connect example.com:993 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :
# в принципе аналогично проверяются и другие сервисы

Next, you need to check here your serial number, and if it is in the list, it is recommended to update the certificate(s).

To update certificates, you can use certbot:

certbot renew --force-renewal

The problem was identified on February 29, 2020, and to resolve the issue, certificate issuance was suspended from 3:10 UTC to 5:22 UTC. According to an internal investigation, the error was introduced on July 25, 2019, and the company will provide a more detailed report later.

UPD: the online certificate verification service may not work from Russian IP addresses.

Source: habr.com