← Internet Security Research Group cases
Bugzilla #1391867
Certificate Problem Report
Let's Encrypt: Non-BR-Compliant Certificate Issuance
RESOLVED
Internet Security Research Group
AI Summary
This case addresses a compliance issue with Let's Encrypt regarding the issuance of non-Baseline Requirements (BR) compliant certificates. The CA was notified of the problem on August 10, 2017, and promptly applied a fix to their infrastructure. They confirmed that they ceased issuing the problematic certificates and provided a list of affected certificates. The issue stemmed from a mistake in their software code that was not caught during review, but was resolved on the same day it was reported.
Chronology
- Let's Encrypt notified of compliance issue
- Fix applied to production infrastructure
Participants
Kathleen Wilson
Josh Aas
External References
Similar Local Cases
Let's Encrypt: 2019.08.20 Incident: Incorrect OCSP responses under certain conditions
Let's Encrypt: Case-sensitive CAA tag processing
Let's Encrypt: certificate lifetimes 90 days plus one second
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Improper encoding of wildcard certificates
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: OCSP "unauthorized" responses
Let's Encrypt: Incomplete revocation for CAA rechecking bug