The Let's Encrypt nonprofit certificate authority, community-controlled and offering certificates free of charge to anyone interested, about the upcoming revocation of many previously issued TLS/SSL certificates. Of the 116 million currently valid certificates, Let’s Encrypt will revoke just over 3 million (2.6%), of which approximately 1 million are duplicates associated with one domain (the error mainly affected frequently updated certificates, which is why there are so many duplicates). The revocation is scheduled for March 4 (the exact time is not yet determined, but the revocation will occur no earlier than 3 AM MSK).
The need for revocation is due to the issue identified on February 29 . The problem has been present since July 25, 2019, and affects the CAA record validation system in DNS. A CAA record (, Certificate Authority Authorization) allows a domain owner to explicitly specify the certificate authority through which certificates for the specified domain can be generated. If the certificate authority is not listed in the CAA records, it must block the issuance of certificates for that domain and notify the domain owner of any compromise attempts. In most cases, a certificate is requested right after passing the CAA check, but the verification result is considered valid for an additional 30 days. The rules also stipulate that a recheck must be performed no later than 8 hours before the issuance of a new certificate (i.e., if 8 hours have passed since the last check when requesting a new certificate, a recheck is required).
The error occurs if the certificate request covers multiple domain names, each of which requires a CAA record check. The essence of the error is that during the recheck, instead of validating all the domains, only one domain from the list was rechecked (if there were N domains in the request, instead of N separate checks, one domain was checked N times). No recheck was performed for the other domains, and the data from the first check (i.e., data up to 30 days old) was used in decision-making. As a result, within 30 days after the first check, Let’s Encrypt could issue a certificate even if the CAA record value had changed and Let’s Encrypt was removed from the list of acceptable certificate authorities.
Users affected by the issue have been notified via email if contact details were provided when obtaining the certificate. You can check your certificates by uploading serial numbers of revoked certificates or using the (hosted on an IP address, by Roskomnadzor in Russia). You can find the serial number of the certificate for the domain of interest using the command:
openssl s_client -connect example.com:443 -showcerts /dev/null \
| openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d :
Source: opennet.ru
