Let's Encrypt: Potential Denial of Service against websites with broad private key reuse
Let’s Encrypt reported that it discovered a bug in its ACME implementation that affected certificate revocation. The issue was triggered when a subscriber revoked a certificate using the revocation reason "keyCompromise"; due to the bug, the revoker only proved control of the FQDNs rather than the certificate private key, which then caused cascading revocation of other certificates based on the SPKI hash. In the reported incident, the SPKI hash matched approximately 130,000 certificates, and the automated revocation stressed Let’s Encrypt’s systems and led to alerts investigated by SRE. Let’s Encrypt deployed a patch within eight hours of discovering the bug and also began work on a hotfix, including identifying CPS Section 4.9.12 and deciding not to stop the revoke endpoint because doing so would be a policy violation more severe than the potential denial of service. The bug was filed as a responsible disclosure, and the case is marked RESOLVED with resolution FIXED. A later comment indicated the bug could be made publicly viewable, and Mozilla stated it would close the bug unless additional comments were provided.
- A subscriber revoked a certificate with reason "keyCompromise", triggering cascading automated revocation of ~130,000 certificates due to an ACME revocation bug.
- Let’s Encrypt identified the issue, confirmed behavior in staging, and began work on a hotfix.
- Let’s Encrypt merged a hotfix after deciding not to stop the revoke endpoint to avoid a policy violation.
- Community commenter — J.C. Jones [:jcj] reported the ACME revocation bug, described how "keyCompromise" revocations cascaded based on SPKI hash, provided an incident timeline, and linked to a hotfix/patch commit.
- Kflag representative — j**********s@kflag.net said the information could be made publicly viewable now.
- Community commenter — Ben Wilson said he would close the bug the next day unless there were additional comments or questions.