No. 012 · Clock Room

The Root That Expired

· a long tail on old devices

  1. 1An old root certificate reaches its long-announced expiry date
  2. 2Modern systems use the newer root and don't notice
  3. 3Old phones, old OpenSSL and embedded devices still trust only the old one
  4. 4TLS handshakes start failing on those clients
  5. 5Fixes range from config changes to buying new hardware ✕

An expiry date years away is still a date. Put it in a calendar.

Source: Let's Encrypt announcements, 2020 to 2021

Let's Encrypt root expiry, September 2021. Duration: a long tail on old devices. 5 hops from the first change to the failure.