Let’s Encrypt discovers CAA bug, must revoke customer certificates
'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code. The bug opens up a window of time in which a certificate might be issued even if a CAA record in that domain's DNS should prohibit it. As a result, Let's Encrypt is erring on the side of security and safety rather than convenience and revoking any currently issued certificates it can't be certain are legitimate, saying: Unfortunately, this means we need to revoke the certificates that were affected by this bug, which includes one or more of your certificates. To avoid disruption, you'll need to renew and replace your affected certificate(s) by Wednesday, March 4, 2020. We sincerely apologize for the issue. If you're not able to renew your certificate by March 4, the date we are required to revoke these certificates, visitors to your site will see security warnings until you do renew the certificate.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-revoking... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/
On Wed, 4 Mar 2020 11:00:40 +1300, Peter Reutemann quoted:
'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code.'
I think this only applies to wildcard domain certs (e.g. “*.example.com”). The mechanism for issuing a cert to a specific domain (e.g. “www.example.com”) does not use DNS CAA records. I say this because I didn’t need to set up a CAA record for any of the domains for which I have obtained Let’s Encrypt certs. <https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization>
I wrote:
I think this only applies to wildcard domain certs (e.g. “*.example.com”).
Sorry, no, I understand now, this is meant to provide an additional safeguard to prevent rogue CAs from issuing unauthorized certs for random domains. So it’s something that can apply to any domain. <https://geekflare.com/dns-caa-record/>
On Wed, 4 Mar 2020 11:00:40 +1300, Peter Reutemann quoted:
'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code.'
According to this <https://www.theregister.co.uk/2020/03/03/lets_encrypt_cert_revocation/>, the bug was caused by “a common mistake in Go: taking a reference to a loop iterator variable”.
participants (2)
-
Lawrence D'Oliveiro -
Peter Reutemann