← Internet Security Research Group cases
Bugzilla #1645276
Certificate Problem Report
Let's Encrypt: Expired ISRG Root OCSP X1 Certificate
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt experienced an issue with an expired OCSP signing certificate issued by ISRG Root X1, which led to OCSP validation errors for clients verifying intermediate certificates. The certificate expired on June 4, 2020, and was reissued on June 9, 2020, after the problem was reported. During the downtime, a significant number of requests were affected, with approximately 2.9% of clients encountering validation failures. The incident was resolved by issuing a new certificate and implementing monitoring to prevent future occurrences.
Chronology
- Security officers received a report about the expired OCSP signing certificate.
- New OCSP responses were generated and served after the certificate was reissued.
Participants
Andrew Gabbitas
bwilson@mozilla.com
pporada@letsencrypt.org
External References
Similar Local Cases
Let's Encrypt: Failure to revoke key-compromised certificate within 24 hours
Let's Encrypt: Certificates issued to Elliptic Curve Debian Weak Keys
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Early CRL Removal Incident
Once Revoked Let's Encrypt Certificate Actively Signing Malware
Let's Encrypt: End Entity CRLs Not Reissued On Time
Let's Encrypt: Delayed revocation for removed gTLD
Let's Encrypt: Failure to provide OCSP Responses for some certificates