Let’s Encrypt – Revocation of Certificates 4pm 28th January – Information

by UC-Reseller Admin | Jan 26, 2022 | 3CX, Featured, Press Releases, UC-Reseller, Vodia

Let’s Encrypt have announced this morning that it plans to revoke some certificates at 4 pm on Friday 28th January.

In emails sent to Let’s Encrypt users the certificate authority said:

Hello,

Please immediately renew your TLS certificate(s) that were issued from
Let’s Encrypt using the TLS-ALPN-01 validation method and the following
ACME registration (account) ID(s):

 

XXXXX

 

We’ve determined that an error made it possible for TLS-ALPN-01
challenges, completed before today, to not comply with certificate
issuance requirements. We have remediated this problem and will revoke
all unexpired certificates that used this validation method at 16:00 UTC
on 28 January 2022. Please renew your certificates now to ensure an
uninterrupted experience for your site visitors.

 

We apologize for any inconvenience this may cause. If you need support
in the renewal process, please comment on our forum post. Our staff and
community members are available to help:

 

https://community.letsencrypt.org/t/170449

 

Thank you,

 

The Let’s Encrypt Team

 

What does this mean for you?

In the telecommunications industry, it is commonplace to use Let’s Encrypt certificates, and a number of Unified Communications vendors do which include 3CX, Vodia and many more. It is important to note that it is far more widespread than just the Unified Communications space and can affect anything that uses Let’s Encrypt certificates.

It affects certificates that were issued from Let’s Encrypt using the validation method TLS-ALPN-01 prior to 5:21 am on the 26th January 2022, certificates that were issued using this validation method prior to this time, are to be revoked on Friday 28th at 4 pm.

Not all certificates are affected by the incorrect implementation of the “TLS using ALPN” validation method. The revocation will only apply to certificates issued that were validated by TLS-ALPN-01 method.

Let’s Encrypt Site Reliability Engineer (SRE), Jillian said:

“We estimate 1% of active certificates are affected. Subscribers affected by revocations will recieve an email notification if the ACME account contains a valid email address. If you are affected by this recocation and need help renewing your certificate please ask questions in this thread.”

Given that Let’s Encrypt as of November 2021 had in excess of 221 million certificates, this could still be in the millions affected, if they were issued with the incorrect implementation of the “TLS using ALPN” validation method TLS-ALPN-01.

He continued:

“We will provide more details about this incident in the next few days.”

The reason why Let’s Encrypt is taking this action is that they have determined that an error made it possible for TLS-ALPN-01 challenges, completed before today (26/01/2022), to not comply with certificate issuance requirements.

What do resellers need to do to ensure their end users are not affected?

Vodia Response:

UC-Reseller spoke with the CEO of Vodia Christian Stredicke, who confirmed:

“Vodia does not use the TLS-ALPN-01 validation method so our Resellers and their End-Users will not be affected.”

he continued:

“In the new version of Vodia you can also check the expiration date of the certificates in the certificates list, and there is also an option to renew the certificate on the same page.”

3CX Response:

The issue was raised with 3CX this morning at 8:19 am, in the forums and a response was provided by 3CX at 11:40 am, confirming:

We’ve looked into this and I can confirm that we do not use the TLS-ALPN-01 validation method so there’s no need to worry as 3CX Instances are unaffected and no action is needed.

If you are using 3CX provided Let’s Encrypt Certificate the above confirmation provides comfort that you will not be affected, but if you use your own custom FQDN and a Let’s Encrypt Certificate you may well use the TLS-ALPN-01 validation method, and you should renew your certificates manually.

Instructions for 3CX Custom FQDNs and Let’s Encrypt Certificates:

Open an SSH session to your 3CX instance and run the following commands in order, one at a time:

sudo apt -y update

sudo apt install python3-acme python3-certbot python3-mock python3-openssl python3-pkg-resources python3-pyparsing python3-zope.interface

sudo apt install python3-certbot-nginx

sudo certbot –nginx

If this is your first time running certbot, you will be prompted to enter an email address and agree to the terms of service. After doing so, certbot will communicate with the Let’s Encrypt server, then run a challenge to verify that you control the domain you’re requesting a certificate for.

If that’s successful, certbot will ask how you’d like to configure your HTTPS settings.

Output

 

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.

——————————————————————————-

1: No redirect – Make no further changes to the webserver configuration.

 

2: Redirect – Make all requests redirect to secure HTTPS access. Choose this for

new sites, or if you’re confident your site works on HTTPS. You can undo this

change by editing your web server’s configuration.

 

——————————————————————————-

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel):

Select your choice then hit ENTER. The configuration will be updated, and Nginx will reload to pick up the new settings. certbot will wrap up with a message telling you the process was successful and where your certificates are stored:

Output

 

IMPORTANT NOTES:

– Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/your_domain/fullchain.pem

Your key file has been saved at:

 

/etc/letsencrypt/live/your_domain/privkey.pem

 

Your cert will expire on YYYY-MM-DD. To obtain a new or tweaked

version of this certificate in the future, simply run certbot again

with the “certonly” option. To non-interactively renew *all* of

your certificates, run “certbot renew”

 

– Your account credentials have been saved in your Certbot

configuration directory at /etc/letsencrypt. You should make a

secure backup of this folder now. This configuration directory will

also contain certificates and private keys obtained by Certbot so

making regular backups of this folder is ideal.

 

– If you like Certbot, please consider supporting our work by:

 

Donating to ISRG / Let’s Encrypt:   https://letsencrypt.org/donate

Donating to EFF:                    https://eff.org/donate-le