77

Stack Exchange's certificates are in need of renewal ASAP due to the Let's Encrypt CAA rechecking bug. They have sent out notification emails to affected users but I'm reporting this here just in case.

https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864

Revoking certain certificates on March 4

Due to the 2020.02.29 CAA Rechecking Bug 343, we unfortunately need to revoke many Let’s Encrypt TLS/SSL certificates. We’re e-mailing affected subscribers for whom we have contact information.

Stack Exchange sites still seem to be affected by this:

serial 03d535edf09fbbda42c10ce8c633d53938d9 41934525 310f021f1e122f07350e774097cbfe1ee5304ce01feaf67e6aa6461b4c9bc5c0 names: [*.askubuntu.com *.blogoverflow.com *.mathoverflow.net *.meta.stackexchange.com *.meta.stackoverflow.com *.serverfault.com *.sstatic.net *.stackexchange.com *.stackoverflow.com *.stackoverflow.email *.superuser.com askubuntu.com blogoverflow.com mathoverflow.net openid.stackauth.com serverfault.com sstatic.net stackapps.com stackauth.com stackexchange.com stackoverflow.blog stackoverflow.com stackoverflow.email stacksnippets.net superuser.com] missing CAA checking results for *.blogoverflow.com at 2020-01-23 08:00:29.44135833 +0000 UTC

Improve this question
11
  • 15
    Thanks for the heads up, we're investigating
    – Dean Ward
    Mar 3, 2020 at 13:22
  • 12
    Thanks a bunch - out of curiosity where'd you notice this from? We get Let's Encrypt's normal notification emails to a team account just fine, but we haven't (yet) gotten any notification whatsoever about these impending revocations (and not a peep about it on their social media channels) - so you might've saved us an outage.
    – Shane Madden
    Mar 3, 2020 at 13:57
  • 3
    @ShaneMadden I noticed it on Hacker News IIRC, then I decided to run a check for the websites I've visited. (My own certs weren't affected, probably because they were renewed a few days ago.)
    – alexia
    Mar 3, 2020 at 14:11
  • 5
    Kudos and thanks! We're in the process of renewing our certs that's affected. Appreciate the heads up!
    – Peter Kay
    Mar 3, 2020 at 14:35
  • 22
    Wow. Thanks so much for posting this - last week was a very long one and you just saved our team another (very surprising) headache <3
    – Nick Craver
    Mar 3, 2020 at 16:28
  • 1
    Just as another datapoint, we got the email notification for this just an hour ago, after we already renewed one affected certificate. So it does seem like they're sending out notifications, but rather slowly given the very short timeframe until revocation.
    – Mad Scientist
    Mar 3, 2020 at 16:45
  • Does SE have a way to automatically monitor their cert expire dates?
    – Pedro Lobito
    Mar 3, 2020 at 16:45
  • 2
    @PedroLobito This is not about expiration, the certificates are going to be revoked before they expire
    – Mad Scientist
    Mar 3, 2020 at 16:46
  • 1
    @MadScientist Was there a way to discover this without being informed by LE?
    – Pedro Lobito
    Mar 3, 2020 at 16:51
  • 5
    @PedroLobito we monitor our cert's expire dates via SignalFx. We built a custom collector to collect that data via httpunit. Our certs were to expire sometime in April. Due to this bug, our certs would be revoked tomorrow, hence the last minute renewal fiasco. We would have only known through communication from LE or Meta.
    – Peter Kay
    Mar 3, 2020 at 16:56
  • An explanation of what happened is offered here: serverfault.com/q/1007743/290545
    – Rob
    Mar 24, 2020 at 6:59

1 Answer 1

Reset to default
59

Thanks again for bringing to our attention about our certificates being affected by the Let's Encrypt CAA Rechecking Bug. Unfortunately, we didn't get any notifications from LE to act sooner, which means you saved us from a potential outage! We went ahead and renewed our certs via DNSControl to our loadbalancers and Fastly.

As seen from the Unbound Test, we should be good to go!

The certificate currently available on stackoverflow.com is OK. It is not one of the certificates affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0312a85b4142d24485783fb47a865d46a83a

Improve this answer
3
  • 2
    Looks good, I tested the rest of the domains too.
    – alexia
    Mar 3, 2020 at 17:19
  • 6
    Awesome, now the poster needs a special badge!
    – djsmiley2kStaysInside
    Mar 3, 2020 at 18:26
  • 3
    Time to revive the Hacker Badge? ;)
    – Shadow The Spring Wizard
    Mar 3, 2020 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .