Let's Encrypt tls-sni-01 disabled due to credible vulnerability report
Josh from Let's Encrypt here. I'm not able to give many more details yet, but here's what I can add now:<p>1) This isn't a relatively simple issue like a bug in our CA code would be. It's an interaction between the protocol and provider services.<p>2) Disabling TLS-SNI is a complete mitigation for us, meaning it's no longer possible to get an illegitimate certificate from Let's Encrypt by exploiting this issue.<p>3) We have not yet reached a conclusion as to whether or not the TLS-SNI challenge will need to remain disabled permanently.<p>4) At this point we have no reason to believe that the vulnerability has been exploited by anyone other than the researcher who figured it out and reported it to us.<p>Our focus now is on sharing information with relevant parties and looking for less drastic mitigations that might allow us to restore the TLS-SNI challenge option to people who rely on it.<p>We will, of course, share more information as soon as we can. That might be as soon as the next few hours, things are moving quickly.