At 16:48 UTC on Tuesday Jan 25, 2022, a third party informed Let’s Encrypt / ISRG that, while examining the Boulder codebase, they had noticed two instances of specification non-compliance in our implementation of the “TLS Using ALPN” validation method (BRs 3.2.2.4.20, RFC 8737). As a result, we have made two changes to the way that our TLS-ALPN-01 challenge validation works. All active certificates that were issued and validated with the TLS-ALPN-01 challenge before 00:48 UTC on 26 January 202...
