Re: Digicert revoking certain certs failing CNAME validation

[Tom Beecher <beecher () beecher cc>]

Not shocked. At least one company got a TRO preventing the 24h revocation.

Honestly I think it's the right thing anyway. It doesn't make a ton of
sense to punish everyone else because the CA itself screwed up
and *created* a circumstance that happens to meet one of the 24h / no
extension conditions.

On Wed, Jul 31, 2024 at 12:14 AM Peter Fisher <mail () phyn3t com> wrote:

> Actually it looks like they have updated their incident page (
> https://status.digicert.com/incidents/3sccz3v31lc9) with a new revocation
> date depending on if you get an exception. Also more details can be found
> here(https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c5).
>
> On Tue, Jul 30, 2024 at 12:45 PM Peter Fisher <mail () phyn3t com> wrote:
>
> > I have not noticed any revocation yet for my affected certificates. Has
> > anyone had their affected certificates revoked yet?
> >
> > On Tue, Jul 30, 2024 at 12:35 PM Innocent Obi <innocent.obijr () gmail com>
> > wrote:
> >
> > > Luckily it seems my org has since mitigated this, but it would be
> > > interesting to know the broader impacts/who is broadly impacted.
> > >
> > > On Tue, Jul 30, 2024 at 12:20 PM Tom Beecher <beecher () beecher cc> wrote:
> > >
> > > > If you're only getting this now, you're probably in trouble, because
> > > > they're revoking affected certs in about 15 mins.
> > > >
> > > > On Tue, Jul 30, 2024 at 2:53 PM Innocent Obi <innocent.obijr () gmail com>
> > > > wrote:
> > > >
> > > > > Just in-case this hasn't made its way around:
> > > > > https://www.digicert.com/support/certificate-revocation-incident.