DNS Validation Error Caused DigiCert to Revoke Thousands of Certificates

DigiCert discovered that a modernization of its domain validation system omitted the required underscore prefix on random values used for CNAME-based domain control validation, affecting about 0.4% of validations. Because the omission violates CA/Browser Forum Baseline Requirements, DigiCert revoked the impacted certificates, notified customers to reissue replacements within the mandated timeframe, and outlined corrective actions including restoring the underscore, additional testing, and architecture reviews. The report also provides guidance on verifying certificate revocation via certutil and OCSP.