Millions of websites could soon no longer have valid TLS certificates after provider Let’s Encrypt was hit by a bug, leaving its certificates at risk of being inaccessible or unsecure.
Let’s Encrypt, which is run by Internet Security Research Group, provides free Transport Layer Security (TLS) certificates for websites owners.
Go deeper with GlobalData
TLS certificates mean that the information transferred from one machine to another when a user visits a website is encrypted, and so cannot be intercepted by a third party.
However, a bug in the certificate authority code has been discovered, affecting the automated system that validates users before certificates are issued, meaning that websites using a Let’s Encrypt TLS/SSL certificate will display “insecure” warnings to users, and communications will not be encrypted.
Earlier this week, the company issued a statement saying it would revoke 2.6% of currently active certificates, amounting to over three million, and that affected subscribers had been notified. Let’s encrypt has issued certificates to a total of 190 million websites.
Companies using Let’s Encrypt certificates advised to renew them
Let’s Encrypt has told those affected to renew or replace certificates.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe original deadline for revoking certificates was yesterday, but the company has made the decision to push back the deadline, saying that “rather than potentially break so many sites and cause concern for their visitors, we have determined that it is in the best interest of the health of the Internet for us to not revoke those certificates by the deadline”.
Kevin Bocek, VP Security Strategy and Threat Intelligence at machine identity protection company Venafi said:
“Digital certificates, such as those issued by Let’s Encrypt, provide machines – be that websites, servers, applications, IoT devices, everything – with a unique identity to enable encrypted and secure communication with other machines. Most recognisably, perhaps, is that they enable the little padlock in the URL bar which tells us that a site has been secured; or in this case, a lack of a certificate can trigger a warning to users that a site is not secured.
He explains that events such as this can be costly or damaging for organisations if they do not act quickly:
“Millions of machines may drop off the internet and be untrusted causing damaging and costly outages. Angry customers, angry executives. When an event such as this happens, organisations need to be able to quickly swap out their old machine identities for new, secure ones. But most organisations do not understand or have visibility of their machine identities. They don’t know how many identities they have – a figure that could be in the 10s of thousands – they do not know who issued them, or what they are being used for. Added to this, the only way they can update them is to go through and manually find and replace every single one.
He believes that having greater visibility of machine identities within an organisation can help resolve such situations:
“Ultimately, as digital transformation becomes increasingly complex, we are likely to see issues such as these more frequently. This is just one more reason why security teams need to provide their business with visibility and automation through Machine Identity Protection to find and replace all compromised machine identities in seconds – regardless of CA used. In today’s volatile environment, businesses must use Machine Identity Protection or risk being untrusted and essentially kicked off the internet on any given day.”
Read more: SSH keys: How nation state attacks are falling into the hands of cybercriminals.
