DigiCert mass-revoking TLS certificates due to domain validation bug

**Executive summary:** DigiCert discovered a five-year bug in its Domain Control Verification process that omitted the required underscore in some CNAME-based validations, impacting about 0.4% of validations (83,267 certificates, 6,807 customers). Under CABF rules DigiCert will revoke affected certificates within 24 hours and requires customers to reissue certificates via CertCentral to avoid connectivity loss; the company says the chance of a collision is extremely low and no exploitation has been reported.