DIGICERT REVOKES 83K TLS CERTIFICATES DUE TO DOMAIN VALIDATION BUG

Summary from the TLDR InfoSec newsletter

DigiCert announced that it will be revoking 0.4% of certificates issued from August 2019 to June 2024. The CABF baseline domain verification requirement is to publish a CNAME record with the domain followed by an underscore and random value. A bug introduced in August 2019 led to some code paths not appending the underscore which could potentially lead to clashes between the record and subdomains. DigiCert says this is unlikely due to the random value having 150 bits of entropy, but nevertheless has notified customers that it will be revoking affected certificates.