Let’s Encrypt to Revoke Millions of TLS Certs

[Gandalf_The_Grey]

Content source

https://threatpost.com/lets-encrypt-revoke-millions-tls-certs/153413/

On Wednesday millions of Transport Layer Security certificates will be revoked because of a Certificate Authority Authorization bug.
Popular free certificate authority Let’s Encrypt said it will revoke 3 million Transport Layer Security (TLS) certificates Wednesday, because of a Certificate Authority Authorization (CAA) bug. The move could mean that millions of websites and machine identities that rely on those certificates to protect sensitive data flow could be identified as insecure, or rendered unavailable.
Certificate users contacted by Threatpost said they were notified of the revocation Tuesday and given 24 hours to resolve the issue. Certificates will be revoked March 4, 9:00 p.m. EST.
“I manage 200 domains across 20 servers and have until the end of the day to fix the problem,” said Mark Engelhardt, IT consultant with Intuitive Engineering, in Montpelier, Vt. “Let’s Encrypt did not handle this in an ideal fashion at all.”

Let's Encrypt to Revoke Millions of TLS Certs

On Wednesday millions of Transport Layer Security certificates will be revoked because of a Certificate Authority Authorization bug.

threatpost.com

 

[Gandalf_The_Grey]

Let’s Encrypt Pushes Back Deadline to Revoke Some TLS Certificates
While 1.7 million of the certificates potentially affected by a CAA bug have already been replaced, around 1 million are still active.
Let’s Encrypt said it will give users of its Transport Layer Security (TLS) certificates more time to replace 1 million certificates that are still active and potentially affected by a Certificate Authority Authorization (CAA) bug before it revokes them.

Let’s Encrypt Pushes Back Deadline to Revoke Some TLS Certificates

While 1.7 million of the certificates potentially affected by a CAA bug have already been replaced, around 1 million are still active.

threatpost.com

2020.02.29 CAA Rechecking Bug

After learning about and remediating a bug in our CAA checking code [1] on 2020-02-29 UTC (the evening of Friday February 28, U.S. Eastern time), we announced that we would be revoking approximately 2.6% of our active certificates that were potentially affected by the bug, totalling...

community.letsencrypt.org