DigiCert validation bug sets up 83,267 SSL certs for revoking

The CABF requires that, in a single format of the DNS CNAME entry, the random worth be prefixed with an underscore, and DigiCert found that, in some instances, that character was not included, rendering the validation non-compliant. By CABF guidelines, these certificates have to be revoked inside 24 hours, with no exceptions.

Nevertheless, DigiCert stated in an replace to its standing web page Tuesday, and in an e-mail to prospects, “Sadly, some prospects working crucial infrastructure aren’t ready to have all their certificates reissued and deployed in time with out crucial service interruptions. To keep away from disruption to crucial providers, we have now engaged with browser representatives alongside these prospects during the last a number of hours. Primarily based on these discussions, we at the moment are ready to delay revocations underneath distinctive circumstances.”

Since then, DigiCert up to date its standing web page to learn, “DigiCert continues to actively interact with prospects impacted by this incident and plenty of of them have been in a position to exchange their certificates. Some prospects have utilized for a delayed revocation on account of distinctive circumstances and we’re working with them on their particular person conditions. We’re not accepting any purposes for delayed revocation.”