← Internet Security Research Group cases
Bugzilla #1715455
Certificate Problem Report
Let's Encrypt: certificate lifetimes 90 days plus one second
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt identified an issue where their certificates, intended to have a validity of 90 days, were actually valid for 90 days plus one second due to the inclusivity defined in RFC 5280. This discrepancy was brought to their attention via an email on June 8, 2021. In response, Let's Encrypt quickly deployed a fix to adjust the certificate lifetime to comply with the standard, ensuring that all new certificates issued would adhere to the correct validity period. The incident did not disrupt certificate issuance, as a fix was implemented promptly.
Chronology
- Received notification about the certificate validity issue.
- Internal incident declared and fix deployed.
Participants
Josh Aas
Ryan Sleevi
Jesper Kristensen
Lee Yiu Chung
Michel Lebihan
Aaron Friel
External References
Similar Local Cases
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Incomplete revocation for CAA rechecking bug
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: OCSP Responder Returned "Unauthorized" for Some Precertificates
Let's Encrypt: Failure to revoke for Certificate Lifetime Incident
Let's Encrypt: Case-sensitive CAA tag processing
Let's Encrypt: Non-BR-Compliant Certificate Issuance
Let's Encrypt: 2019.08.20 Incident: Incorrect OCSP responses under certain conditions