[Update 2020-03-05: The most up-to-date summary is at 2020.02.29 CAA Rechecking Bug]
Due to the 2020.02.29 CAA Rechecking Bug, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information.
This post and thread will collect answers to frequently asked questions about this revocation, and how to avoid problems by renewing affected certificates early. If you’re affected, please: thoroughly read this thread, and search the community forum, for an answer to your question. If you don’t find one, please make a new post to the “Help” category, filling in the questions in the template that appears as you compose your post.
Q: How many certificates are affected?
A: Updated 2020-03-05: Of the original 3,048,289 certificates that were affected, over 1.7M have been replaced and revoked. There are more than 1M whose status is either unknown or not replaced. Of the original 3M affected certificates, about 1M were duplicates of other affected certificates, in the sense of covering the same set of domain names.
Because of the way this bug operated, the most commonly affected certificates were those that are reissued very frequently, which is why so many affected certificates are duplicates.
Q: When will the revocations start?
A: Updated 2020-03-05: The following certificates were revoked prior to the compliance deadline at 2020-03-05 03:00 UTC (9pm U.S. ET 2020-03-04):
- 1,706,505 certificates that we are confident were replaced during the incident period
- 445 certificates that we treated as highest priority for revocation because, at the time we found the bug, they had CAA records that forbid issuance by Let’s Encrypt.
We plan to revoke more certificates as we become confident that doing so will not be needlessly disruptive to Web users. Please continue to renew and replace affected certificates. If there are any changes to revocation plans, updates will be provided in this thread. Thank you all very much for your patience, understanding, and help as we work through this issue.
Q: How do I know if I’m using an affected certificate?
A: Here is an online tool that will show you: https://checkhost.unboundtest.com/
Or, on a Linux/BSD-like system, this command will show you example.com's current certificate serial number:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d :
You can see the list of all affected serial numbers at: https://letsencrypt.org/caaproblem/
Q: I received the email telling me I should renew my certificate, however, the online testing tool isn’t indicating my cert needs replacing.
A: Even if you received an email, it’s possible that the affected certificates have been replaced by newer certs not affected by the bug. (Either due to being issued in the last few days since it was fixed, or simply by not meeting the specific timing criteria necessary for the bug to trigger.) In that case, it’s not necessary to renew them again. You can use the checking tool at https://checkhost.unboundtest.com/ to verify if the certificate you’re currently using needs renewal, or verify that the serial number of the cert you’re currently using is present in the list of affected certs at https://letsencrypt.org/caaproblem/.
Q: I get this error when trying to renew: "urn:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new cert :: too many certificates already issued for exact set of domains"
A: This usually means your client has been renewing every day, which means you likely have a newer, unaffected certificate already. Check your hostname with https://checkhost.unboundtest.com/.
We’ve also increased the duplicate certificate limit so fewer people will get this error.
If you’d like to suggest more questions or corrections for this post, please make a new post to the “Site Feedback” category.
Thank you all very much for your patience, understanding, and help as we work through this issue.
