While 1.7 million of the certificates potentially affected by a CAA bug have already been replaced, around 1 million are still active.
Source: Threadpost