Mohamed Sharaf
Menu
Infrastructure

Let’s Encrypt is revoking 3 million certificates

A bug means millions of certificates will be revoked tomorrow. Check yours and renew today, or visitors will see errors.

· 1 min read

Let’s Encrypt found a bug in how it checked CAA records, a DNS setting that says which authorities may issue certificates for a domain. Because of it, about 3 million certificates will be revoked starting tomorrow, 4 March.

A revoked certificate makes browsers show a security warning. For an online shop or a login page, that’s an outage.

What to do today:

  1. Check your domains with the tool Let’s Encrypt published, or the list of affected serial numbers.
  2. Renew affected certificates now. With certbot, a forced renewal does it.
  3. Restart or reload web servers, mail servers and load balancers so they use the new certificate.
  4. Don’t forget the places nobody remembers: APIs, mail, internal tools with public certificates.

This is also a good test of your automation. If renewing everything at short notice is hard, fix that next.

ShareWhatsAppLinkedInXTelegramFacebook