After learning about and remediating a bug in our CAA checking code [1] on 2020-02-29 UTC (the evening of Friday February 28, U.S. Eastern time), we announced that we would be revoking approximately 2.6% of our active certificates that were potentially affected by the bug, totalling approximately 3 million certificates [2]. We announced the plan to revoke because even though the vast majority of the certificates in question do not pose a security risk, industry rules require that we revoke ce...| Let's Encrypt Community Support
On 2020-02-29 UTC, Let’s Encrypt found a bug in our CAA code. Our CA software, Boulder, checks for CAA records at the same time it validates a subscriber’s control of a domain name. Most subscribers issue a certificate immediately after domain control validation, but we consider a validation good for 30 days. That means in some cases we need to check CAA records a second time, just before issuance. Specifically, we have to check CAA within 8 hours prior to issuance (per BRs §3.2.2.8), so...| Let's Encrypt Community Support
Go Wiki: LoopvarExperiment| go.dev
RESOLVED (jsha) in CA Program - CA Certificate Compliance. Last updated 2023-02-22.| bugzilla.mozilla.org