Let's Encrypt will revoke 3 million certificates on March 4 2020

ciao70

• March 03, 2020 13:32

Hello, Download affected certificate serials for 2020.02.29 CAA Rechecking Incident

• 

  ciao70

  • March 03, 2020 18:39

  Incident Status Security Issue [Identified] Due to the 2020.02.29 CAA Rechecking Bug, we unfortunately need to revoke 2.6% of active Let"s Encrypt TLS/SSL certificates. We are in the process of notifying some Let's Encrypt users that their certificates will be revoked on 04 March 2020. Updates are available on our community forum community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864 If you want to double check whether a given hostname still needs its certificate replaced, you can use the tool at

  0
• 

  panayot

  • March 03, 2020 18:50

  I just received an email from Let's Encrypt about revocation of a certificate tomorrow. I am running an older version of cpanel (76) and one of the domains there is affected. I am not sure if this is an issue with all cpanel servers. Let's Encrypt are revoking 2.6% of all of their certificates (3 million). Anyone know how to force cpanel to renew an AutoSSL certificate? Here is the email that I got: =========================================== ACTION REQUIRED: Renew these Let's Encrypt certificates by March 4 We recently discovered a bug in the Let's Encrypt certificate authority code, described here: Please search thoroughly for a solution before you post a new question. Let's Encrypt staff will help our community try to answer unresolved questions as quickly as possible.

  0
• 

  ciao70

  • March 03, 2020 18:52

  Hello,

  0
• 

  cPanelLauren

  • March 03, 2020 19:24

  I combined the two threads here in relation to this issue. In reference to the @ciao70's initial post and Let's Encrypt's announcements for certificate revocation, there are some things to be aware of:

  • Check whether a host's certificate needs replacement or by running the following: openssl s_client -connect example.com:443 -showcerts /dev/null | openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d :
    
    • The list of affected serial numbers is here: caa-rechecking-incident-affected-serials.txt.gz
    • If you have a large number of domains they're recommending using the tool here:

  0

Please sign in to leave a comment.