Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Let’s Encrypt to Revoke 3 Million SSL Certificates on March 4
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Let’s Encrypt to Revoke 3 Million SSL Certificates on March 4

https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591

On 2020-02-29 UTC, Let’s Encrypt found a bug in our CAA code. Our CA software, Boulder, checks for CAA records at the same time it validates a subscriber’s control of a domain name. Most subscribers issue a certificate immediately after domain control validation, but we consider a validation good for 30 days. That means in some cases we need to check CAA records a second time, just before issuance. Specifically, we have to check CAA within 8 hours prior to issuance (per BRs §3.2.2.8), so any domain name that was validated more than 8 hours ago requires rechecking.

The bug: when a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times. What this means in practice is that if a subscriber validated a domain name at time X, and the CAA records for that domain at time X allowed Let’s Encrypt issuance, that subscriber would be able to issue a certificate containing that domain name until X+30 days, even if someone later installed CAA records on that domain name that prohibit issuance by Let’s Encrypt.

We confirmed the bug at 2020-02-29 03:08 UTC, and halted issuance at 03:10. We deployed a fix at 05:22 UTC and then re-enabled issuance.

Our preliminary investigation suggests the bug was introduced on 2019-07-25. We will conduct a more detailed investigation and provide a postmortem when it is complete.

Thanked by 1PulsedMedia

Comments

  • DPDP Administrator, The Domain Guy

    Deja vu.

    Thanked by 1AlwaysSkint
  • @thedp said:
    Deja vu.

    I've just been in this place before

  • PulsedMediaPulsedMedia Member, Patron Provider

    So this concerns multi-domain certs only?
    How unsurprising - i've personally never liked multidomain or wildcard certs due to various security concerns ...

  • spunspun Member

    On March 3 I had SSL certificate issues on 3 different sites. Most of my sites were unaffected. I wish I would have seen this sooner and I could have made adjustments accordingly.

  • @spun said:
    On March 3 I had SSL certificate issues on 3 different sites. Most of my sites were unaffected. I wish I would have seen this sooner and I could have made adjustments accordingly.

    They sent out emails on March 3. You missed it by this much.

    While I applaud them for putting out a fix in 2 hours, taking 3 days to send a less than 24 hours notice is super lame. They definitely need to improve that in the future.

  • TimboJones said: taking 3 days to send a less than 24 hours notice is super lame. They definitely need to improve that in the future.

    The less than 24 hours wasn't really their choice... The Baseline Requirements for certificate authorities requires them to revoke misissued certificates within five days, and it took them a little while to determine exactly which certificates were affected by the bug (given their limited staffing as a non-profit). Maybe you should ask for your money back.

Sign In or Register to comment.