3 ms·

Perhaps that's why it was broken? I only see certificate issuances from Let's Encrypt. https://crt.sh/?q=addons.thunderbird.net https://crt.sh/?q=addons.thund

• tialaramex 5y ago
  The Cloudflare certificate which expired was for *.thunderbird.net which you will be able to find in crt.sh for yourself - and was issued a year ago under Cloudflare's intermediate† None of those R3 certificate expire today, and the expired cert I was originally served when this was a fresh news item was from that Cloudflare intermediate CA under DigiCert. It's possible that normally Thunderbird has Cloudflare trust their backends via the Let's Encrypt certificate rather than using Cloudflare's private "origin" CA for that purpose. That would give them the flexibility to cut Cloudflare out of the loop if necessary. But what exactly happened here I expect we'll learn in a post-mortem. † I assume but don't know for certain that in fact DigiCert operates this intermediate CA simply on behalf of Cloudflare but entirely on their own premises and with them ensuring its obeys the CA/B BRs and other trust store policies. I think the idea of letting somebody else operate unconstrained intermediates with them doing all the work died out after it sank Symantec.
  • wila 5y ago
    Ahh yes that makes perfect sense, thanks. I do indeed see the Cloudflare one from a year ago. Seems it was now renewed as a Let's Encrypt one.