Let's Encrypt: Wednesday evening three million HTTPS certificates will be invalid

Because of a securityproblems, the certification authority Let's Encrypt invalidates around 3 million TLS certificates on Wednesday evening. As a result, some system admins have to work an hour in the evening to prevent HTTPS errors from appearing on website visitors.

Let's Encrypt is probably the easiest way to create a TLS certificate (required for HTTPS) for your homepage on the Internet. Because of a securityproblems, every user could apply for a certificate for any domain. As a result, certificates created with the faulty software must now be invalidated. According to Let's Encrypt, the error occurred since July 2019 in the open source tools Boulder, which was fixed last Sunday. This is responsible for checking the correct domain.

Oh yes: We know of course that it is called an SSL certificate - but intentionally given that title to make our article easier to find.

Let's Encrypt: First certificates invalid after 20:00 p.m.

In order to continue to guarantee the authenticity of the possibly falsely generated certificates, they are now being withdrawn. To ensure that Let's Encrypt is ready before the deadline on Thursday, 03:00, work will begin today at 20:00. From this point on, the first certificates will become invalid - a total of around 3 million are affected. This corresponds to less than three percent of the total of around 116 million active certificates. As a system administrator and website operator, you should therefore be prepared for this tool Check whether the certificate used for your own website is affected. If your homepage appears here and you are not an admin, it is best to contact your provider today so that there are no problems tomorrow.

If you use the Certbot to create the certificates, submit certbot renew –force-renewal to the console to renew all active certificates on the host. Nevertheless, a pretty drastic step on the part of Let's Encrypt, as users have only been notified of this via email for a day. Well - a system administrator should be able to react promptly anyway.