Let's Encrypt: Case-sensitive CAA tag processing
The case reports that Let’s Encrypt improperly handled CAA records with mixed-case tag values, which resulted in mis-issuance under the CA/B Baseline Requirements. The issue was triggered when Let’s Encrypt received an incident report to its c**********s@letsencrypt.org contact address at 12:45 UTC. The reporter noted that RFC 6844 specifies case-insensitive matching of tag values, but Let’s Encrypt’s CAA validation processed tags case-sensitively, causing non-lowercase tags to be ignored. Let’s Encrypt confirmed the problem, developed and reviewed a fix within an hour, deployed it to staging, disabled new certificate issuance in production, and then deployed the fix to production. Let’s Encrypt revoked one certificate identified by the reporter as issued in violation of the CAA RFC. Later, Let’s Encrypt implemented CAA logging improvements, scanned CAA records for the prior 90 days, identified 11 certificates that would not have been issued, sent emails to ACME account contacts with four days to respond, revoked the remaining 8 after no responses, and considered the incident closed.
- Let’s Encrypt received an incident report about mixed-case CAA tag handling that led to mis-issuance.
- Let’s Encrypt deployed a fix, disabled production issuance temporarily, and revoked the certificate identified by the reporter.
- Let’s Encrypt completed CAA logging improvements and a scan, revoked affected certificates, and closed the incident.
- Community commenter — Josh Aas reported that mixed-case CAA tags were processed case-sensitively, leading to CAA validation ignoring non-lowercase tags; he described the fix timeline, production issuance disablement, and revocation of the reporter-identified certificate.
- Fastly representative — Wayne Thayer asked Josh to update the bug with the status of the proposed remediation actions.
- Kflag representative — Josh Aas stated that CAA logging improvements were committed, a scan identified 11 certificates that would not have been issued, emails were sent to ACME account contacts with four days to respond, three certificates expired during the response window, the remaining eight were revoked, and the incident was closed.