← Internet Security Research Group cases
Bugzilla #1742704
Certificate Problem Report
Let's Encrypt: Potential Denial of Service against websites with broad private key reuse
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt identified a bug in their ACME implementation that could lead to a denial of service by allowing unauthorized revocation of certificates. The issue arose when a certificate was revoked using the 'keyCompromise' reason without proper proof of control over the private key, leading to a cascading revocation of approximately 130,000 certificates. A patch was deployed within eight hours of discovery, and the incident was reported to the CA/B Forum Management list for responsible disclosure. The bug highlights potential vulnerabilities in ACME implementations and the need for stringent controls during certificate revocation.
Chronology
- Bug discovered and patch deployed
- Incident reported to CA/B Forum Management list
Participants
J.C. Jones [:jcj]
Ben Wilson
External References
Similar Local Cases
Let's Encrypt: keyCompromise key blocking deviation from CP/CPS
Let's Encrypt: End Entity CRLs Not Reissued On Time
Let's Encrypt: OCSP responses with no revocationReason
Let's Encrypt: No Meaningful Subject Distinguished Name
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Failure to Document Analysis of Detected Vulnerabilities
Let's Encrypt: Incomplete and Inconsistent CRLs
Let's Encrypt: Case-sensitive CAA tag processing