Let's Encrypt going to revoke thousands of certificates

FanJ · Jan 27, 2022

2022.01.25 Issue with TLS-ALPN-01 Validation Method - January 26, 2022, 2:51am
https://community.letsencrypt.org/t/2022-01-25-issue-with-tls-alpn-01-validation-method/170450

At 16:48 UTC on Tuesday Jan 25, 2022, a third party informed Let’s Encrypt / ISRG that, while examining the Boulder codebase, they had noticed two instances of specification non-compliance in our implementation of the “TLS Using ALPN” validation method (BRs 3.2.2.4.20, RFC 8737). As a result, we have made two changes to the way that our TLS-ALPN-01 challenge validation works.
Click to expand...

All active certificates that were issued and validated with the TLS-ALPN-01 challenge before 00:48 UTC on 26 January 2022 when our fix was deployed are considered mis-issued. In compliance with the Let’s Encrypt CP, we have 5-days to revoke and will begin to revoke certificates at 16:00 UTC on 28 January 2022. We estimate <1% of active certificates are affected. Subscribers affected by revocations will receive e-mail notifications if their ACME account contains a valid e-mail address. If you are affected by this revocation and need help renewing your certificate please ask questions in this thread
Click to expand...

Questions about Renewing before TLS-ALPN-01 Revocations
https://community.letsencrypt.org/t/questions-about-renewing-before-tls-alpn-01-revocations/170449

On 26 January 2022, Let's Encrypt notified subscribers (with a valid contact email) that on 28 January 2022 we we will revoke certificates issued in the last 90 days and validated with the TLS-ALPN-01 challenge. This revocation only affects certificates issued and validated with the TLS-ALPN-01 challenge. Not all clients are capable of using this challenge type. Certbot does not support this challenge type, so unless you received an e-mail about this Certbot users should be unaffected.
Click to expand...

This post and thread will collect answers to frequently asked questions about this revocation, and how to avoid problems by renewing affected certificates early. If you're affected, please: thoroughly read this thread, and search the community forum, for an answer to your question. If you don't find one, please make a new post in the 'Help' category, filling in the questiosn in the template that appear as you compose your post. Below, you will find some in-progress threads for certain clients and an F.A.Q that we will be regularly updating
Click to expand...

Changes to TLS-ALPN-01 challenge validation
https://community.letsencrypt.org/t/changes-to-tls-alpn-01-challenge-validation/170427

Note by me:
Let me emphasize this part:
All active certificates that were issued and validated with the TLS-ALPN-01 challenge before 00:48 UTC on 26 January 2022 when our fix was deployed are considered mis-issued.

Log in or Sign up

Let's Encrypt going to revoke thousands of certificates

FanJ Updates Team

Log in or Sign up

Let's Encrypt going to revoke thousands of certificates

FanJ Updates Team

Useful Searches