← Internet Security Research Group cases
Bugzilla #1619179
Delayed Revocation
Let's Encrypt: Incomplete revocation for CAA rechecking bug
RESOLVED
FIXED
Internet Security Research Group
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Let's Encrypt reported a bug related to incomplete revocation due to a CAA rechecking issue. After discovering the bug on February 29, 2020, they announced plans to revoke approximately 3 million potentially affected certificates. They successfully revoked 1.7 million certificates by the compliance deadline but decided not to revoke over 1 million certificates to avoid significant disruption to web services. Let's Encrypt committed to a plan for ongoing revocation of remaining certificates as they are replaced, with all affected certificates either revoked or expired by May 29, 2020. The case is now resolved.
Chronology
- Let's Encrypt discovered a bug in their CAA checking code.
- Let's Encrypt revoked 1,711,396 certificates by the compliance deadline.
- All affected certificates have expired or been revoked.
Thread Activity
- Kflag representative — Let's Encrypt reported the bug and outlined their revocation plan.
- Fastly representative — Mozilla emphasized that exceptions to revocation requirements are not granted.
- Kflag representative — Let's Encrypt provided an update on the revocation progress.
- Fastly representative — It was confirmed that all questions have been answered and remediation is complete.
Participants
Kflag representative
Fastly representative
Community commenter
Internet Security Research Group
External References
Similar Local Cases
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Failure to revoke for Certificate Lifetime Incident
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Failure to revoke key-compromised certificate within 24 hours
Let's Encrypt: Delayed revocation for removed gTLD
Let's Encrypt: End Entity CRLs Not Reissued On Time
D-TRUST: Delayed revocation of EV certificates
Buypass: Intermediate certificates not listed in audit reports