← Internet Security Research Group cases
Bugzilla #1639794
Certificate Problem Report
Let's Encrypt: Failure to revoke key-compromised certificate within 24 hours
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt received a report on May 5, 2020, regarding a compromised private key and associated certificates. Although the report was processed within 24 hours, a procedural error led to a delay in the actual revocation, which occurred 37 hours and 21 minutes after the report was received. The incident prompted Let's Encrypt to revise its revocation procedures to reduce human error and improve compliance with the necessary standards. The CA has since implemented automated processes to handle such incidents more effectively.
Chronology
- Report of compromised key received.
- Certificate revoked after routine check.
- Boulder update deployed to improve revocation process.
Participants
mpalmer@hezmatt.org
jsha@letsencrypt.org
agabbitas@letsencrypt.org
pporada@letsencrypt.org
bwilson@mozilla.com
ryan.sleevi@gmail.com
External References
Similar Local Cases
Sectigo: Failure to revoke key-compromised certificate within 24 hours
GoDaddy: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Certificates issued to Elliptic Curve Debian Weak Keys
Let's Encrypt: Expired ISRG Root OCSP X1 Certificate
SwissSign: failure to provide a preliminary report within 24 hours
Asseco DS / Certum: Incorrect OCSP response encoding
GlobalSign: Failure to revoke key-compromised certificate within 24 hours
Let's Encrypt: Early CRL Removal Incident