Certainly: TLS Using ALPN TLS Version and OID

Certainly LLC discovered a vulnerability related to the TLS-ALPN-01 validation method after being notified of a related issue by Let’s Encrypt. Following this, Certainly disabled the affected validation method and revoked all certificates that relied on it. The incident was declared on January 25, 2022, and all affected certificates were revoked by January 26, 2022. A full incident report was prepared and shared, detailing the timeline of actions taken and the nature of the certificates involved. The CA has since completed remediation efforts and is monitoring the situation.

1. 2022-01-25 Certainly declares an incident after assessing vulnerability to TLS-ALPN-01 method.
2. 2022-01-26 All affected certificates are revoked.
3. 2022-02-10 Certainly completes remediation of the incident.

1. 2022-01-28 Fastly representative — Certainly was notified of a vulnerability and took immediate action to revoke affected certificates.
2. 2022-02-02 Nekollc representative — Questions raised regarding the timing of certificate revocations.
3. 2022-02-11 Mozilla representative — Indicated intention to close the case unless further concerns arise.