Digital certificates are one of the pillars of TLS-protocolthe one that assures us that we are connecting to the website that we have put in the address bar and the one that encrypts communications, so that only the website and we can see what we exchange.
The calls are issued certification authoritiescompanies or organizations such as Camerfirma, DigiCert or Entrust, and in order for us to obtain one they must verify that we have control of the website for which we want the certificate, preventing other people from trying to supplant it.
One of the largest certification authorities today, Let’s Encrypt, a non-profit organization that has gained enormous popularity for be a free service and very easy to automate, has detected a potential security issue in your implementation of the ALPN method used to verify domain ownership. As a consequence, and applying the provisions of its policies, it has decided to revoke on January 28 all certificates that have been verified with this method issued before 00:48 UTC on January 26, 2022.
Among all the available validation methods, ALPN is the least used, so revocation affects less than 1% of all active certificates, according to data from Let’s Encrypt itself. It may not seem like much, but there are currently close to 220 million active certificatess yours in total, so about 2.2 million certificates will be revoked, although it is likely that many of them are being used on servers not accessible to the general public.
This is the second major news regarding certificates issued by Let’s Encrypt in recent months. In September of last year one of your root certificates expired, the ones used to validate the ones it issues, which went unnoticed by systems that are kept up-to-date, but affected those that aren’t. In no case can these failures be blamed on Let’s Encrypt, which warned of the change and prepared it months in advance, but it should draw attention to the importance that this service has gained and the need to be aware of its warnings.
José Couto, Head of Security at Paradigma Digital
