3 ms·
All my recent certificates are affected. I think it is the same case for the majority of us.
by Ayesh 7y ago
All my recent certificates are affected. I think it is the same case for the majority of us.
- vesinisa 7y agoI use DNS validation to obtain one certificate with both domain.tld and *.domain.tld wildcard. My certificates seem not to be affected. My certs last auto-renewed on 2020-02-20.
- deleted 7y ago[deleted]
- tialaramex 7y agoThe most likely cause will be that you issued similar certificates a few days (more than eight hours) earlier with the same Let's Encrypt account. Suppose on Wednesday you get a cert for example.com and www.example.com, and then on Thursday you realise you also need images.example.com - you use the same ACME account (if you run Certbot this will happen by default if you use the same machine and user account, it silently makes you a free account if you don't have one already) and so Let's Encrypt can see that this account showed proof-of-control for two of these names on Wednesday, so only fresh proof-of-control of images.example.com is needed. Unfortunately this bug means Let's Encrypt forgot to re-check CAA for the old names, and so there's a risk they technically were no longer authorised to issue for these names and shouldn't have given you the Thursday certificate. Rather than try to argue about whether it's appropriate to disregard this check, Let's Encrypt decided to revoke all ~3 million affected certificates. That's maybe 2-3 days worth of normal issuance in the last 90 days, so lots but hardly "the majority".