Let's Encrypt: Failure to audit log subscriber certificate OCSP updates

Let's Encrypt identified a compliance issue regarding the logging of OCSP updates for subscriber certificates. While initial certificate issuance was logged correctly, subsequent updates were not, violating baseline requirements. The issue was discovered during an internal audit, and although it affected all certificates issued from their Intermediate Certificate Authorities, issuance was not halted. Remediation steps included software updates to ensure proper logging, with a target completion date set for January 31, 2021. The necessary changes have since been deployed.

1. 2020-12-22 Internal audit detected non-compliance with OCSP update logging.
2. 2021-01-29 Updated CA software with logging changes deployed.
3. 2021-04-02 Bug closure planned as remediation was completed.