← Internet Security Research Group cases
Bugzilla #1486650
Certificate Problem Report
Let's Encrypt: OCSP "unauthorized" responses
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt experienced an incident on August 23, 2018, where a configuration change to their OCSP responder service led to 90% of traffic receiving incorrect OCSP "unauthorized" statuses for valid requests. The issue was identified and resolved within hours, but some cached responses continued to be affected. The root cause was a bug in the implementation of a feature designed to manage malformed OCSP traffic. Remediation steps have been completed to enhance monitoring and prevent similar issues in the future.
Chronology
- Configuration change deployed to OCSP responder
- Issue identified and feature disabled in production
Participants
Wayne Thayer
Josh Aas
External References
Similar Local Cases
Let's Encrypt: Improper encoding of wildcard certificates
Let's Encrypt: Case-sensitive CAA tag processing
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: 2019.08.20 Incident: Incorrect OCSP responses under certain conditions
Let's Encrypt: certificate lifetimes 90 days plus one second
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Non-BR-Compliant Certificate Issuance
Let's Encrypt: OCSP Responder Returned "Unauthorized" for Some Precertificates