← Internet Security Research Group cases
Bugzilla #1446080
Certificate Problem Report
Let's Encrypt: Improper encoding of wildcard certificates
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt encountered an issue with the encoding of wildcard certificates, where the subject common name included a ‘*.’ label encoded as an ASN.1 PrintableString, violating RFC 5280. This problem was identified on March 13, 2018, and all affected certificates were revoked. The root cause was traced to a bug in the Go programming language, which has since been resolved. In response, Let's Encrypt has integrated additional testing tools to enhance their testing infrastructure and prevent similar issues in the future.
Chronology
- Problem identified with wildcard certificate encoding.
- Certificates revoked and testing improvements initiated.
- Integration of certlint into testing completed.
- All actions completed; case marked as resolved.
Participants
Wayne Thayer
Josh Aas
External References
Similar Local Cases
Let's Encrypt: OCSP "unauthorized" responses
Let's Encrypt: Case-sensitive CAA tag processing
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Non-BR-Compliant Certificate Issuance
Let's Encrypt: certificate lifetimes 90 days plus one second
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Incomplete revocation for CAA rechecking bug
Let's Encrypt: 2019.08.20 Incident: Incorrect OCSP responses under certain conditions