Let's Encrypt to revoke about 2 million certificates

[alan6854321]

Saw this on 'The register', does it have any bearing on the Lets Encrypt certificate loaded on the DDNS page of my router?
Tried to follow the tech stuff through but it all got a bit beyond me....

Let's Encrypt to revoke about 2 million HTTPS certificates

Relatively small number of certs issued using verification method that doesn't comply with policy

www.theregister.com

 

[heysoundude]

I'm no expert, but as long as you've been updating Merlin (and are relatively current) on your router, I would tend to think you're not affected but I'll gladly defer to people who ACTUALLY know this stuff: Merlin (asus?) Implemented TLS 1.3 some time ago iirc, and dropped the insecure version at that time...wouldn't surprise me if John's Fork is good too.
#TrustbutVerify

 

[Jack Yaz]

to my knowledge, the problem isn't tied to any client used to get a LE cert, the issue was caused on LE's side when they generated and issued the certs. you'll get an email from LE if they have your email tied to a cert, otherwise you'll spot an issue when your browser starts complaining about anything you're using your LE cert for!

 

[alan6854321]

otherwise you'll spot an issue when your browser starts complaining about anything you're using your LE cert for!

If that were to happen, how do I tell the router to update its certificate?

 

[Jack Yaz]

If that were to happen, how do I tell the router to update its certificate?

i would hope that when the next cronjob call to acme goes through it would renew it - i think its nightly
if not, not sure to be honest!

 

[john9527]

It's related to a particular mode to validate the certificate ownership....TLS-ALPN. It's used when the validation needs to occur over http/https, but for some reason the default http port 80 is unavailable. (I use it because my ISP, Cox, blocks port 80 and my domain is registered with Google Domains which doesn't have a ddns validation api).
As far as I know, if you are using Asus DDNS, they do the validation with a ddns api, so wouildn't be affected.

I'm waiting to see if I get a notification email.