Let's Encrypt: certs issued contrary to CPS due to incomplete blocklist

This case describes an issuance blocklist problem at Let’s Encrypt that caused the CA to issue certificates contrary to its CPS. Mozilla was informed that between 11:30am and 4pm Pacific on November 21, 2016, a bug in the blocklist assembly script was identified, confirmed, and fixed; the script incorrectly and silently failed to process a small number of blocklist entries. Let’s Encrypt staff worked to identify all domains/blocks that had failed to propagate and any certificates issued for those domains. The thread lists several certificates found to have been mis-issued by policy (including certificates for gov.ir, gov.sy, and .mil), and states that all unexpired certificates were revoked and account contacts were notified. Mozilla’s representative discussed that the concern was compliance with CP/CPS and noted that revocation had been performed. Later, Let’s Encrypt stated that the buggy code/script had been deleted and the blacklist is now a static text document, and Mozilla indicated the issue was dealt with to its satisfaction.

1. 2016-11-21 Let’s Encrypt identified and fixed a bug in its blocklist assembly script that caused incomplete blocklist propagation.
2. 2016-11-23 A Mozilla CA Program compliance bug was filed describing the misissuance-by-policy incident and listing affected certificates.
3. 2017-04-05 Let’s Encrypt reported the buggy script was deleted and the blacklist process changed to a static document; Mozilla closed the matter to its satisfaction.

1. 2016-11-23 Mozilla representative — Reported that a blocklist script bug caused some blocklist entries not to propagate, leading to certificates issued contrary to CPS/CP, and stated affected certificates were identified and all unexpired certificates were revoked with account contacts notified.
2. 2016-11-23 Mozilla representative — Discussed Mozilla’s concern as CP/CPS compliance and stated that, given revocation, no further action was necessary at that time.
3. 2016-11-23 Kflag representative — Provided CPS/CP context for why some domains (e.g., .mil) are called out while others (e.g., gov.ir/gov.sy) are not explicitly listed.
4. 2017-04-05 Kflag representative — Stated the buggy script was deleted and the blacklist is now a static text document, and asked for an update on progress toward closing the issue.
5. 2017-04-05 Mozilla representative — Indicated the issue had been dealt with to Mozilla’s satisfaction.