← Internet Security Research Group cases
Bugzilla #1648840
Certificate Problem Report
Let's Encrypt: OCSP responses with no revocationReason
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt identified a bug in their OCSP response system that caused revoked certificates to be served with an unspecified revocation reason after three days, despite the correct status being indicated. This issue was discovered during routine maintenance and was promptly addressed with a fix deployed on June 19, 2020. The bug originated from a code change made in 2016 that inadvertently omitted the revocation reason from the database query. The CA has since ceased generating OCSP responses with this issue.
Chronology
- Change merged that introduced the bug.
- Boulder release containing the bug was deployed.
- Let's Encrypt SRE discovers problem.
- Fix merged and deployed.
Participants
Jacob Hoffman-Andrews
Ryan Sleevi
Ben Wilson
External References
Similar Local Cases
Let's Encrypt: OCSP Responder Returned "Unauthorized" for Some Precertificates
Let's Encrypt: Incomplete revocation for CAA rechecking bug
Let's Encrypt: Failure to revoke for Certificate Lifetime Incident
Let's Encrypt: Potential Denial of Service against websites with broad private key reuse
Let's Encrypt: certificate lifetimes 90 days plus one second
Let's Encrypt: CAA Rechecking bug
Let's Encrypt: Duplicate Serial Numbers
Let's Encrypt: 302 total OCSP responses available beyond acceptable timelines