The DigiCert DCV Bug: Implications and Industry Impact

On July 28, 2024 DigiCert disclosed a bug in its DNS-based Domain Control Validation (DCV) process that made 83,267 certificates non‑compliant, prompting mandatory revocation and reissuance within 24 hours; Censys observed tens of thousands of affected certificates in use (33,201 on July 30, 26,373 on August 6). The report details the root cause (failure to enforce an underscore prefix in DNS DCV challenges), the scale and industry impact (notably Technology and Telecommunications, with companies like Vodafone and Bloomberg affected), operational consequences including customer disruption and legal action, and the potential security risk that some dynamic DNS services could be abused to obtain certificates for domains they do not own.