[Update 2020-03-05: The most up-to-date summary is at 2020.02.29 CAA Rechecking Bug ] Due to the 2020.02.29 CAA Rechecking Bug , we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information. This post and thread wi…

Your script does not retrieve the correct serialnumber when the server uses SNI. You need to indicate the servername: openssl s_client -connect example.com:443 -showcerts -servername example.com </dev/null 2>/dev/null | openssl x509 -text -noout | grep -A 1 Serial\ Number | tr -d :

Thanks @kjo , that’s a good point.

Good point @kjo . I believe recent versions of openssl actually do use the connect string to set the SNI field, but I agree that older versions do not, and we should have the more robust command.

When I first heard about this problem, at about 1600 UTC, I had not received an email. But i thought to check, so I ran a script and discovered one current certificate was affected. Several hours later, when I was about to double check my script after reading kjo’s comment, I noticed that I had rec…

[image] tmcl: Please someone from Let’s Encrypt staff, if you can edit the original article, make it clear that non-receipt of an email is not equivalent to being unaffected. That's a great point. I'll get this change worked up now. FWIW, the notification mailer has completed it's run.

I’m not really sure if https://checkhost.unboundtest.com/ is working correctly, for one of my affected domains it’s showing The certificate currently available on [name] is OK ... but the file downloaded from https://letsencrypt.org/caaproblem/ is still showing missing CAA checking results for [nam…

@vedranl Would you mind letting me know what the domains/certs in question are so I can check?

Looks like I can’t send private messages, any way to send this in private?

[image] vedranl: I’m not really sure if https://checkhost.unboundtest.com/ is working correctly Maybe you renewed the certificate, so only the old one, not used anymore, is affected and will be revoked? (for example if you had the wrong configuration for certbot: renew-by-default which rene…

@Phil Is there any plan to push back the start time of the revocations since some people (like me) literally just received the email notice in the last 2 hours which is just over 4 hours before midnight UTC?

Revoking certain certificates on March 4

Help

Topic		Replies	Views
Questions about Renewing before TLS-ALPN-01 Revocations Help	219	52619	February 8, 2022
Sometimes it's required to break the rules - and to change these Praise	18	4028	March 7, 2020
Receiving emails saying certificate are soon to expire, but they are not Help	11	574	July 17, 2022
Too many certificates already issued for exact set of domains Server	20	6054	July 15, 2017
Confused :: expiry warning for non-expiring certificate Help	23	4065	July 18, 2016

Revoking certain certificates on March 4

Related topics