Systems engineer Ian Clark used a binary code to spell out “Dare Mighty Things” in the orange and white strips of the 70-foot (21-meter) parachute. He also included the GPS coordinates for the mission’s headquarters at the Jet Propulsion Laboratory in Pasadena, California. Clark, a crossword hobbyist, came up with the idea two years ago. Engineers wanted an unusual pattern in the nylon fabric to know how the parachute was oriented during descent. Turning it into a secret message was “super fun,” he said Tuesday. Only about six people knew about the encoded message before Thursday’s landing, according to Clark. They waited until the parachute images came back before putting out a teaser during a televised news conference Monday.

Let's Encrypt uses Certificate Authority software called Boulder. Typically, a Web server that services many separate domain names and uses Let's Encrypt to secure them receives a single LE certificate that covers all domain names used by the server rather than a separate cert for each individual domain.

The bug LE discovered is that, rather than checking each domain name separately for valid CAA records authorizing that domain to be renewed by that server, Boulder would check a single one of the domains on that server n times (where n is the number of LE-serviced domains on that server). Let's Encrypt typically considers domain validation results good for 30 days from the time of validation—but CAA records specifically must be checked no more than eight hours prior to certificate issuance.

The upshot is that a 30-day window is presented in which certificates might be issued to a particular Web server by Let's Encrypt despite the presence of CAA records in DNS that would prohibit that issuance.