Let’s Encrypt

ronjor · Feb 27, 2020

Let's Encrypt Has Issued a Billion Certificates

Feb 27, 2020 • Josh Aas and Sarah Gran
We issued our billionth certificate on February 27, 2020. We’re going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of certificates - one hundred million.
Click to expand...

guest · Mar 3, 2020

Let's Encrypt to revoke certain certificates on March 4
March 3, 2020
https://www.neowin.net/news/lets-encrypt-to-revoke-certain-certificates-on-march-4

Let’s Encrypt has announced that it will have to revoke many Let’s Encrypt TLS/SSL certificates from March 4. It’s currently in the process of emailing affected subscribers so that they can update their certificates. The need to revoke these certificates comes after a Certificate Authority Authorization rechecking bug was found.

If you use Let’s Encrypt certificates, you can use this tool to find out whether you’ll need to update your certificates. If it looks as though you need to update your certificates it’s advised that you read this thread and search the community forums if you have any questions.
The certificate revocations will begin from 00:00 UTC on March 4 which is less than 8 hours away.
Click to expand...

Revoking certain certificates on March 4

Due to the 2020.02.29 CAA Rechecking Bug 2.2k, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information.
This post and thread will collect answers to frequently asked questions about this revocation, and how to avoid problems by renewing affected certificates early.

Q: How many certificates are affected?
A: 2.6%. That is 3,048,289 currently-valid certificates are affected, out of ~116 million overall active Let’s Encrypt certificates. Of the affected certificates, about 1 million are duplicates of other affected certificates, in the sense of covering the same set of domain names. [...]
[/qute]
Click to expand...

stapp · Mar 5, 2020

Looks like Eicar test site didn't update

guest · Mar 5, 2020

mood said: ↑

Revoking certain certificates on March 4
Click to expand...

Update:

Comment (Let's Encrypt staff)
We have provided an update on the original incident regarding our revocation efforts:
[...] Unfortunately, we believe it’s likely that more than 1 million certificates will not be replaced before the compliance deadline for revocation is upon us at 2020-03-05 03:00 UTC (9pm U.S. ET tonight). Rather than potentially break so many sites and cause concern for their visitors, we have determined that it is in the best interest of the health of the Internet for us to not revoke those certificates by the deadline.

Let’s Encrypt only offers certificates with 90 day lifetimes, so potentially affected certificates that we may not revoke will leave the ecosystem relatively quickly.
The following certificates have been, or will be, revoked prior to the compliance deadline at 2020-03-05 03:00 UTC (9pm U.S. ET tonight): [...]

We plan to revoke more certificates as we become confident that doing so will not be needlessly disruptive to Web users.
Click to expand...

guest · Mar 5, 2020

Canadian Centre for Cyber Security
Let’s Encrypt Certificate Advisory
Number: AV20-053
March 4, 2020
https://cyber.gc.ca/en/alerts/lets-encrypt-certificate-advisory

On 3 March 2020 Let’s Encrypt announced that they would be revoking 3,048,289 TLS/SSL certificates on 4 March 2020 at 3:00pm EST. The revocation was triggered by the discovery of a vulnerability in some certificates that would allow possible forged certificates to be issued under specific circumstances.
Let’s Encrypt is attempting to contact all registered owners of affected certificates through the contact information which was provided to Let’s Encrypt upon registration. The number of certificates being revoked represents 2.6% of all certificates. Upon certificate revocation, an affected web site may become inaccessible to web browsers or may cause the web browser to display a security caution message.

The Cyber Centre recommends that all users of Let’s Encrypt TLS/SSL certificates renew their certificates as soon as possible, whether or not Let’s Encrypt has advised them of an issue with their individual certificate.
For additional information, including tools to test if a certificate is affected, please refer to Let’s Encrypt’s official security advice:
https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864
Click to expand...

guest · Sep 10, 2020

Letsencrypt, the Good, The bad and the Ugly
September 10, 2020
https://jacquesmattheij.com/letsencrypt-good-bad-ugly/

Letsencrypt is a pretty neat concept: free secure certificates for web servers, in order to increase the adoption of HTTPS across the web. The basic idea is that certificates should be free, that the barrier to install them should be as low as possible and that updating certificates should be automated.
The good
The main part - for instance for me - was that letsencrypt automated something that I would otherwise have to do once per year for the domains that are active: create and install a new certificate. A bit of a hassle, about 20 minutes per domain.
And this is where things are not looking all that good for Letsencrypt.
Click to expand...

The bad
The first time this bit me was when a while ago one of my servers suddenly refused to update its certificate. Somewhere someone has decided that Letsencrypt should auto-update even if absolutely nothing had been changed on the system that it was running on. And this automatic update completely and utterly destroyed the runtime environment on that computer, leading to its eventual re-imaging, something that should have never ever happened.

Unfortunately Letsencrypt is no exception to this: the upgrade process is bad enough, it tends to install a whole pile of cruft, whole python virtual environments are dragged in upon cert renewal, which is odd because after all *the situation hasn’t changed and if it worked last time it should still work this time*.
Then the challenge protocol was changed.
Click to expand...

The ugly
A new protocol for the letsencrypt challenges was released, announced in some obscure corner of the web and bit by bit the old method of issuing new certificates was deprecated.
You would not have known this unless you interacted with Letsencrypt on a daily basis, but like most of these things their whole value lies in NOT having to interact with them all the time. They should just shut up, sit in a corner and do their bloody job.

The effect of this is that now Letsencrypt, from a time saver and a convenience has turned itself - for the second time - into a very large net-negative. This is unacceptable for a project that tries to make something easier and where convenience, not financial considerations are a big driver in adoption.
Click to expand...

guest · Sep 19, 2020

Let's Encrypt's New Root and Intermediate Certificates
September 17, 2020
https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html

For starters, we’ve issued two new 2048-bit RSA intermediates which we’re calling R3 and R4. These are both issued by ISRG Root X1, and have 5-year lifetimes. They will also be cross-signed by IdenTrust. They’re basically direct replacements for our current X3 and X4, which are expiring in a year. We expect to switch our primary issuance pipeline to use R3 later this year, which won’t have any real effect on issuance or renewal.

The other new certificates are more interesting. First up, we have the new ISRG Root X2, which has an ECDSA P-384 key instead of RSA, and is valid until 2040. Issued from that, we have two new intermediates, E1 and E2, which are both also ECDSA and are valid for 5 years.

Notably, these ECDSA intermediates are not cross-signed by IdenTrust’s DST Root CA X3. Instead, the ISRG Root X2 itself is cross-signed by our existing ISRG Root X1. An astute observer might also notice that we have not issued an OCSP Signing Certificate from ISRG Root X2.
Click to expand...

Why We Issued an ECDSA Root and Intermediates
There are lots of other articles you can read about the benefits of ECDSA (smaller key sizes for the same level of security; correspondingly faster encryption, decryption, signing, and verification operations; and more). But for us, the big benefit comes from their smaller certificate sizes.
Click to expand...

guest · Nov 6, 2020

Let's Encrypt warns about a third of Android devices will from next year stumble over sites that use its certs
November 6, 2020
https://www.theregister.com/2020/11/06/android_encryption_certs/

Let's Encrypt, a Certificate Authority (CA) that puts the "S" in "HTTPS" for about 220m domains, has issued a warning to users of older Android devices that their web surfing may get choppy next year.

The CA, overseen by the Internet Security Research Group (ISRG), subsequently issued its own root certificate (ISRG Root X1) and applied for it to be trusted with the major software platforms.
Next year, on September 1, 2021, the DST Root X3 certificate that Let's Encrypt initially relied for cross-signing will expire and devices that haven't been updated in the past four years to trust the X1 root certificate may find they're unable to connect to websites securely, not without throwing up error messages, at least. We're looking at you, Android.

"Some software that hasn’t been updated since 2016 (approximately when our root was accepted to many root programs) still doesn’t trust our root certificate, ISRG Root X1," explained Jacob Hoffman-Andrews, a lead developer on Let's Encrypt and senior staff technologist at the Electronic Frontier Foundation, in a notice on Friday.
Click to expand...

"Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let’s Encrypt."
Click to expand...

Let's Encrypt: Standing on Our Own Two Feet

Android has a long-standing and well known issue with operating system updates.
The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it.
If You Use an Older Version of Android
If you’re on an older version of Android, we recommend you install Firefox Mobile, which supports Android 5.0 and above as of the time of writing.

[...] it ships with its own list of trusted root certificates. So anyone who installs the latest Firefox version gets the benefit of an up-to-date list of trusted certificate authorities, even if their operating system is out of date.
Click to expand...

guest · Dec 22, 2020

mood said: ↑

Let's Encrypt warns about a third of Android devices will from next year stumble over sites that use its certs November 6, 2020
Click to expand...

Let's Encrypt will help old Android phones browse securely for three more years
December 22, 2020
https://www.engadget.com/lets-encrypt-android-certificate-extension-090025376.html

Back in November, Let's Encrypt warned that older Android phones stuck running 7.1.1 Nougat or lower won’t be able to visit large portions of the secure web by September 2021. Now, the nonprofit certificate authority has announced that it has found a solution for the problem that will extend older Android phones’ compatibility with its certificates by three years.

Let’s Encrypt says the solution ensures “uninterrupted service to all users” and will avoid “the potential breakage” it was worried about.
Click to expand...

mood said: ↑

Let's Encrypt: Standing on Our Own Two Feet
Click to expand...

[Updated]

Update, December 21 2020
Thanks to community feedback and our wonderful partners at IdenTrust, we will be able to continue to offer service without interruption to people using older Android devices. We flagged the content of this blog post that is no longer accurate.
Click to expand...

wildlights · Jan 8, 2021

Thanks I'll check and try this out

ronjor · Feb 21, 2021

Preparing to Issue 200 Million Certificates in 24 Hours

Feb 10, 2021 • Josh Aas
We recently completed most of the work and investments needed to issue 200 million certificates in a day and we thought we’d let people know what was involved. All of this was made possible by our sponsors and funders, including major hardware contributions from Cisco, Thales, and Fortinet.
Click to expand...

guest · Sep 21, 2021

Let’s Encrypt’s root certificate is about to expire, and it might break your devices
September 21, 2021
https://techcrunch.com/2021/09/21/lets-encrypt-root-expiry/

One of the largest providers of HTTPS certificates, Let’s Encrypt, will stop using an older root certificate next week — meaning you might need to upgrade your devices to prevent them from breaking.

But, as warned by security researcher Scott Helme, the root certificate that Let’s Encrypt currently uses — the IdentTrust DST Root CA X3 — will expire on September 30. After this, computers, devices, and web clients — such as browsers — will no longer trust certificates that have been issued by this certificate authority.
Click to expand...

For the overwhelming majority of website users, there is nothing to worry about and September 30 will be business as usual. Older devices, however, could run into some trouble, much like they did when the AddTrust External CA Root expired back in May. Stripe, Red Hat, and Roku all suffered outages as a result.

“Given the relative size difference between Let’s Encrypt and AddTrust, I have a feeling that the IdenTrust root expiry has the potential to cause more problems,” Helme warned in a blog post, referring to the upcoming expiry.
Click to expand...

Let's Encrypt's Root Certificate is expiring!

On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day so here's what you need to know!

The answer to the question "what will happen when the IdenTrust root expires?" depends on how widespread the types of clients listed above are. I don't know what's floating around out there on the Web, and I don't know what depends on those things either. One thing that I do know, though, is that at least something, somewhere is going to break.
Click to expand...

ronjor · Oct 2, 2021

Resources for Certificate Chaining Help

Oct 1, 2021 • Jacob Hoffman-Andrews
As planned, the DST Root CA X3 has expired and we’re now using our own ISRG Root X1 for trust. We used a cross-sign with DST Root CA X3 to gain broad trust for our certificates when we were just starting out. Now our own root is widely trusted.
Click to expand...

guest · Oct 30, 2021

Let's Encrypt explains last month's outages caused by certificate expiration
October 29, 2021
https://www.zdnet.com/article/lets-encrypt-explains-those-outages-last-month/

Dozens of websites and services reported issues late last month thanks to the expiration of a root certificate provided by Let's Encrypt, one of the largest providers of HTTPS certificates.

Let's Encrypt and other researchers had long warned that the IdentTrust DST Root CA X3 would expire on September 30, and many platforms did heed the calls and updated their systems. But a few did not, causing a minor kerfuffle as users questioned why some of their favorite sites were not working as well as they should.
Click to expand...

Scott Helme, the founder of Security Headers, told ZDNet that he confirmed issues with Palo Alto, Bluecoat, Cisco Umbrella, Catchpoint, Guardian Firewall, Monday.com, PFsense, Google Cloud Monitoring, Azure Application Gateway, OVH, Auth0, Shopify, Xero, QuickBooks, Fortinet, Heroku, Rocket League, InstaPage, Ledger, Netlify and Cloudflare pages, but noted that there may have been more that went unreported.

Josh Aas, executive director of the Internet Security Research Group at Let's Encrypt, told ZDNet that he was frustrated with how some outlets covered the September outages, with some implying it was a mistake or an accident.
Click to expand...

ronjor · Apr 17, 2022

Let's Encrypt Wins Levchin Prize For Work On Internet Security

April 15, 2022
Let’s Encrypt is part of the effort to encrypt the entire internet as a means of maximizing privacy and security online.
Click to expand...

stapp · Sep 5, 2022

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
Click to expand...

https://nakedsecurity.sophos.com/20...y-co-creator-of-lets-encrypt-dies-at-just-43/

FanJ · Sep 8, 2022

stapp said: ↑

https://nakedsecurity.sophos.com/20...y-co-creator-of-lets-encrypt-dies-at-just-43/
Click to expand...

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
Click to expand...

Rest in Peace, Peter
A very big loss. Much too young
Thanks for all you did for internet security !!!
My Sympathies go out to Peter's family and friends

You will be missed Peter !!!

Thanks @stapp for letting us know the very sad news.

FanJ · Sep 8, 2022

Let's Encrypt - A New Life for Certificate Revocation Lists
Sep 7, 2022 • Aaron Gable
https://letsencrypt.org/2022/09/07/new-life-for-crls.html

This month, Let’s Encrypt is turning on new infrastructure to support revoking certificates via Certificate Revocation Lists. Despite having been largely supplanted by the Online Certificate Status Protocol for over a decade now, CRLs are gaining new life with recent browser updates. By collecting and summarizing CRLs for their users, browsers are making reliable revocation of certificates a reality, improving both security and privacy on the web. Let’s talk about exactly what this new infrastructure does, and why it’s important.
Click to expand...

Read there more.

FanJ · Dec 20, 2022

A Year-End Letter from our Executive Director
Dec 5, 2022 • Josh Aas
https://letsencrypt.org/2022/12/05/ed-letter-2022.html

The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent security and stability.
Click to expand...

Read there more

FanJ · Dec 20, 2022

Let’s Encrypt improves how we manage OCSP responses
Dec 15, 2022 • Kiel Christofferson
https://letsencrypt.org/2022/12/15/ocspcaching.html

Let’s Encrypt has improved how we manage Online Certificate Status Protocol (OCSP) responses by deploying Redis and generating responses on-demand rather than pre-generating them, making us more reliable than ever.
Click to expand...

OCSP is used to communicate the revocation status of TLS certificates. When an ACME agent signs a request to revoke a certificate, our Let’s Encrypt Certificate Authority (CA) verifies whether or not the request is authorized and if it is, we begin publishing a ‘revoked’ OCSP response for that certificate. Each time a relying party, such as a browser, visits a domain with a Let’s Encrypt certificate, they can request information about whether the certificate has been revoked and we serve a reply containing ‘good’ or ‘revoked’, signed by our CA, which we call an OCSP response.
Click to expand...

Read there more

FanJ · Dec 21, 2022

Enabling ACME CAA Account and Method Binding
Posted by aarongable on Let's Encrypt Community Support - December 16, 2022, 12:25am
https://community.letsencrypt.org/t/enabling-acme-caa-account-and-method-binding/189588

Today we are enabling ACME CAA Account and Method Binding in our production environment.

Certification Authority Authorization (CAA), specified by RFC 8659, is a feature that allows ACME clients to use a specific DNS record to limit which Certificate Authorities are allowed to issue for that domain name. Let's Encrypt has supported CAA for many years, and support for it is mandated by the Baseline Requirements for all CAs.
Click to expand...

Read there more !!!

=====

There is discussion about this on the Dutch site security.nl (sorry, it is in Dutch)
https://www.security.nl/posting/778... bij bevestigen aangevraagde tls-certificaten

FanJ · Jan 11, 2023

An interesting thread yesterday at the Dutch forum Security.nl (it is in Dutch):
Let's Encrypt git.git.git...
https://www.security.nl/posting/781057/Let's Encrypt git_git_git___

I know, it is in Dutch. (Use some translation program if you want)
It points to Let's Encrypt certificates used for "not so fine reasons".

Just have a look at those pokemon-go domains ...

The article points also to for example:
https://www.bleepingcomputer.com/ne...okemon-nft-game-to-take-over-windows-devices/
https://www.bleepingcomputer.com/ne...ydesk-sites-push-vidar-info-stealing-malware/

FanJ · Jan 19, 2023

Thank you to our 2023 renewing sponsors
Jan 19, 2023 • Dan Fernelius
https://letsencrypt.org/2023/01/19/renewing-sponsors.html#

At ISRG, we often say, “as a nonprofit, 100% of our funding comes from charitable contributions.” But what does that actually look like? For nearly a decade, the vast majority of our funding has come from sponsorships—in fact, more than $17 million dollars has been donated to ISRG since 2015. Looking to the year ahead, we wanted to take a moment to thank our renewing sponsors who, quite literally, make our work possible:
Click to expand...

Read there more.

==========

There is still the discussion at Security.nl (to which I pointed in the previous post).
See also https://www.security.nl/posting/782...ijna zestig procent afhankelijk van sponsoren
See there the post "DV-certificaten slopen het internet"
Translated by me: "DV-certificates ruin the internet"

ronjor · May 24, 2023

ISRG’s 10th Anniversary

May 24, 2023 • Josh Aas
Since its founding in 2013, ISRG’s Let’s Encrypt certificate authority has come to serve hundreds of millions of websites and protect just about everyone who uses the Web.
Click to expand...

FanJ · Jul 11, 2023

Shortening the Let's Encrypt Chain of Trust - Android
https://letsencrypt.org/2023/07/10/cross-sign-expiration.html
Jul 10, 2023 • Aaron Gable

This article is important for users of old Android devices.

When Let’s Encrypt first launched, we needed to ensure that our certificates were widely trusted. To that end, we arranged to have our intermediate certificates cross-signed by IdenTrust’s DST Root CA X3. This meant that all certificates issued by those intermediates would be trusted, even while our own ISRG Root X1 wasn’t yet. During subsequent years, our Root X1 became widely trusted on its own.
Click to expand...

Come late 2021, our cross-signed intermediates and DST Root CA X3 itself were expiring. And while all up-to-date browsers at that time trusted our root, over a third of Android devices were still running old versions of the OS which would suddenly stop trusting websites using our certificates. That breakage would have been too widespread, so we arranged for a new cross-sign – this time directly onto our root rather than our intermediates – which would outlive DST Root CA X3 itself. This stopgap allowed those old Android devices to continue trusting our certificates for three more years.
Click to expand...

On September 30th, 2024, that cross-sign too will expire.
Click to expand...

It is important to read the whole article! I cannot quote it all here.
The transition is described there.

Read more there!!!

Perhaps it should be cross-posted at the Android forum here.

Log in or Sign up

Let’s Encrypt

ronjor Global Moderator

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

wildlights Registered Member

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

stapp Global Moderator

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

ronjor Global Moderator

FanJ Updates Team

Log in or Sign up

Let’s Encrypt

ronjor Global Moderator

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

wildlights Registered Member

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

stapp Global Moderator

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

ronjor Global Moderator

FanJ Updates Team

Useful Searches