Let's Encrypt yesterday communicated that it had identified a problem with the system it uses for the automated management of TLS / SSL certificates which led to the generation and issue of over 3 million potentially unsafe certificates: the service had no alternative but to have available the revocation of the certificates which will take place from 8.00 pm UTC on March 4th 2020 (9.00 pm Italian time) until 3.00 am UTC on March 5th 2020 (4.00 pm on Thursday morning March 5th). Let's Encrypt previously stated that the revocation would take effect from last midnight.
The administrators of the websites concerned have already been informed in recent days via email together with the instructions for carrying out the manual renewal of the certificate, the only possible way to overcome the problem. In the event that the certificates are not updated, visitors to the website will see security warnings appear on their browser.
To manage the Let's Encrypt certificates use Boulder, which periodically queries the Certification Authority Authorization servers to verify the correspondence between certificates and domain names. Let's Encrypt has discovered that Boulder does not conduct a proper verification of domain-DNS matches in some situations, and for this reason has issued 3,048,289 potentially unsafe certificates.
A dedicated website has been put online which allows you to check if there is a need to replace the TLS certificate in use. On this page on the Let's Encrypt website, FAQs and more detailed information on the problem are available.
