← Internet Security Research Group cases
Bugzilla #1666047
Certificate Problem Report
Let's Encrypt: 302 total OCSP responses available beyond acceptable timelines
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt reported an incident involving the serving of OCSP responses that exceeded acceptable timelines. Between September 7 and September 13, 2020, OCSP responses for 302 certificate serial numbers were served beyond the specified limits, with the maximum age reaching 5 days. The issue was identified during an on-call shift when elevated error logs triggered an investigation. Remediation actions were taken, including deploying a fix on September 10, 2020, and all affected entries were updated by September 13, 2020. The incident was resolved with no certificates served beyond their validity period.
Chronology
- Incident awareness triggered by elevated error logs.
- Fix deployed to address the root cause.
- Final remediation query executed, all affected entries updated.
Participants
Kiel C
Ryan Sleevi
Aaron Z
External References
Similar Local Cases
Let's Encrypt: Failure to revoke for Certificate Lifetime Incident
Let's Encrypt: Delay updating OCSP responses
Let's Encrypt: certificate lifetimes 90 days plus one second
Let's Encrypt: OCSP Responder Returned "Unauthorized" for Some Precertificates
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: OCSP responses with no revocationReason
Let's Encrypt: TLS Using ALPN TLS Version and OID