Stack Exchange's certificates are in need of renewal ASAP due to the Let's Encrypt CAA rechecking bug. They have sent out notification emails to affected users but I'm reporting this here just in case.


Revoking certain certificates on March 4

Due to the 2020.02.29 CAA Rechecking Bug 343, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information.

Stack Exchange sites still seem to be affected by this:

serial 03d535edf09fbbda42c10ce8c633d53938d9 41934525 310f021f1e122f07350e774097cbfe1ee5304ce01feaf67e6aa6461b4c9bc5c0 names: [*.askubuntu.com *.blogoverflow.com *.mathoverflow.net *.meta.stackexchange.com *.meta.stackoverflow.com *.serverfault.com *.sstatic.net *.stackexchange.com *.stackoverflow.com *.stackoverflow.email *.superuser.com askubuntu.com blogoverflow.com mathoverflow.net openid.stackauth.com serverfault.com sstatic.net stackapps.com stackauth.com stackexchange.com stackoverflow.blog stackoverflow.com stackoverflow.email stacksnippets.net superuser.com] missing CAA checking results for *.blogoverflow.com at 2020-01-23 08:00:29.44135833 +0000 UTC

  • 15
    Thanks for the heads up, we're investigating
    – Dean Ward StaffMod
    Mar 3 '20 at 13:22
  • 12
    Thanks a bunch - out of curiosity where'd you notice this from? We get Let's Encrypt's normal notification emails to a team account just fine, but we haven't (yet) gotten any notification whatsoever about these impending revocations (and not a peep about it on their social media channels) - so you might've saved us an outage. Mar 3 '20 at 13:57
  • 3
    @ShaneMadden I noticed it on Hacker News IIRC, then I decided to run a check for the websites I've visited. (My own certs weren't affected, probably because they were renewed a few days ago.)
    – nyuszika7h
    Mar 3 '20 at 14:11
  • 5
    Kudos and thanks! We're in the process of renewing our certs that's affected. Appreciate the heads up!
    – Peter Kay
    Mar 3 '20 at 14:35
  • 22
    Wow. Thanks so much for posting this - last week was a very long one and you just saved our team another (very surprising) headache <3 Mar 3 '20 at 16:28
  • 1
    Just as another datapoint, we got the email notification for this just an hour ago, after we already renewed one affected certificate. So it does seem like they're sending out notifications, but rather slowly given the very short timeframe until revocation. Mar 3 '20 at 16:45
  • Does SE have a way to automatically monitor their cert expire dates? Mar 3 '20 at 16:45
  • 2
    @PedroLobito This is not about expiration, the certificates are going to be revoked before they expire Mar 3 '20 at 16:46
  • 1
    @MadScientist Was there a way to discover this without being informed by LE? Mar 3 '20 at 16:51
  • 5
    @PedroLobito we monitor our cert's expire dates via SignalFx. We built a custom collector to collect that data via httpunit. Our certs were to expire sometime in April. Due to this bug, our certs would be revoked tomorrow, hence the last minute renewal fiasco. We would have only known through communication from LE or Meta.
    – Peter Kay
    Mar 3 '20 at 16:56
  • An explanation of what happened is offered here: serverfault.com/q/1007743/290545
    – Rob
    Mar 24 '20 at 6:59

Thanks again for bringing to our attention about our certificates being affected by the Let's Encrypt CAA Rechecking Bug. Unfortunately, we didn't get any notifications from LE to act sooner, which means you saved us from a potential outage! We went ahead and renewed our certs via DNSControl to our loadbalancers and Fastly.

As seen from the Unbound Test, we should be good to go!

The certificate currently available on stackoverflow.com is OK. It is not one of the certificates affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0312a85b4142d24485783fb47a865d46a83a


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .