DigiCert Revocation Incident (CNAME-Based Domain Validation)

FanJ · Jul 30, 2024

DigiCert Revocation Incident (CNAME-Based Domain Validation)

July 29, 2024

https://www.digicert.com/support/certificate-revocation-incident

DigiCert will be revoking certificates that did not have proper Domain Control Verification (DCV). Before issuing a certificate to a customer, DigiCert validates the customer’s control or ownership over the domain name for which they are requesting a certificate using one of several methods approved by the CA/Browser Forum (CABF). One of these methods relies on the customer adding a DNS CNAME record which includes a random value provided to them by DigiCert. DigiCert then does a DNS lookup for the domain and verifies the same random value, thereby proving domain control by the customer.

There are multiple valid ways to add a DNS CNAME record with the random value provided for this purpose. One of them requires the random value to be prefixed with an underscore character. The underscore prefix ensures that the random value cannot collide with an actual domain name that uses the same random value. While the odds of that happening are practically negligible, the validation is still deemed as non-compliant if it does not include the underscore prefix.

Recently, we learned that we did not include the underscore prefix with the random value used in some CNAME-based validation cases. This impacted approximately 0.4% of the applicable domain validations we have in effect. Under strict CABF rules, certificates with an issue in their domain validation must be revoked within 24 hours, without exception.
Click to expand...

Customer Action Required

Impacted customers have been notified and must replace their certificates within 24 hours. Please login to your DigiCert account to view impacted certificates and reissue/rekey certificates.
Click to expand...

Long article with guidelines.
Read there more!

FanJ · Aug 1, 2024

Discussion at Bugzilla (I just saw it now):
https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c3

Just one quote from Jeremy Rowley there:

We have identified 83,267 certs impacting 6,807 subscribers.
Click to expand...

FanJ · Aug 1, 2024

There is an update from DigiCert (I just saw it now; sorry!) :
https://status.digicert.com/incidents/3sccz3v31lc9

DigiCert continues to actively engage with customers impacted by this incident and many of them have been able to replace their certificates. Some customers have applied for a delayed revocation due to exceptional circumstances and we are working with them on their individual situations. We are no longer accepting any applications for delayed revocation.
Click to expand...

All certificates impacted by this incident, regardless of circumstances, will be revoked no later than Saturday, August 3rd 2024, 19:30 UTC.
Click to expand...

Read there more!

FanJ · Aug 4, 2024

There seems to be a case at the District Court, D. Utah :
Alegeus Technologies LLC v. DigiCert (2:24-cv-00534)
District Court, D. Utah

https://www.courtlistener.com/docket/68995396/alegeus-technologies-llc-v-digicert/
Last Updated: Aug. 4, 2024, 4:25 a.m.

Log in or Sign up

DigiCert Revocation Incident (CNAME-Based Domain Validation)

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Log in or Sign up

DigiCert Revocation Incident (CNAME-Based Domain Validation)

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Useful Searches