← Internet Security Research Group cases
Bugzilla #1793114
Certificate Problem Report
Let's Encrypt: Incomplete and Inconsistent CRLs
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt reported issues with their Certificate Revocation List (CRL) infrastructure, specifically incomplete CRLs that included only 10% of unexpired and revoked certificates for a period of 30 hours, violating BRs Section 4.10.1. Additionally, for approximately 15 days, revoked serials inconsistently appeared across CRL shards. While both Apple and Mozilla root programs did not classify this as a compliance violation, Let's Encrypt treated it as an incident and has since resolved the first issue and is working on the second. A full incident report was provided detailing the timeline and actions taken.
Chronology
- Initial detection of CRL issues
- Incident report submitted
- External monitor for CRLs deployed
Participants
Aaron Gable
Brett Wilson
External References
Similar Local Cases
Let's Encrypt: Delay updating OCSP responses
Let's Encrypt: Duplicate Serial Numbers
Let's Encrypt: Failure to provide OCSP Responses for some certificates
Let's Encrypt: keyCompromise key blocking deviation from CP/CPS
Let's Encrypt: Failure to revoke for Certificate Lifetime Incident
Let's Encrypt: TLS Using ALPN TLS Version and OID
Certainly: Serving Expired OCSP Responses
Let's Encrypt: Issuance for Invalid Internationalized Domain Name