Let's Encrypt: Delayed revocation for removed gTLD
Let's Encrypt reported that it did not revoke three subscriber certificates within the 5-day revocation timeline required by BRs Section 4.9.1.1 after the relevant gTLD was removed from the root zone. The affected certificates contained names whose use became no longer permitted once their gTLD was removed. Let's Encrypt stated that it later revoked the three certificates and expected to post a complete incident report. In the incident report, Let's Encrypt described how it monitors ICANN’s gTLD list and how automation notified SRE of the `.cancerresearch` gTLD removal on October 6, 2022, but the certificates remained unrevoked past the 5-day window. The report also states that Let's Encrypt stopped issuance for names under the `.cancerresearch` gTLD and revoked the affected certificates. The remediation items were completed when Let's Encrypt updated its gTLD removal alert runbook on 2022-11-23 to include revoking any remaining valid certificates and highlighting required response time, and the bug was marked as FIXED/RESOLVED.
- ICANN removed the `.cancerresearch` gTLD from the root zone, and automation notified Let's Encrypt SRE.
- The 5-day revocation window for `.cancerresearch` certificates closed without revocation of three still-valid certificates.
- Let's Encrypt revoked the affected `.cancerresearch` certificates and confirmed no additional affected certificates under other recently removed gTLDs.
- Let's Encrypt updated its gTLD removal alert runbook to ensure timely revocation of remaining valid certificates.
- Renken representative — Let's Encrypt said it identified a failure to revoke three certificates within the 5-day BRs Section 4.9.1.1 timeline after their gTLD was removed, and stated it had revoked them while expecting to post a complete incident report.
- Renken representative — Let's Encrypt provided an incident report describing monitoring of ICANN’s gTLD list, the `.cancerresearch` removal timeline, and that three certificates remained valid past the 5-day window before being revoked.
- Renken representative — The reporter stated they were continuing to work on remediation items and monitoring the bug for questions.
- Renken representative — The reporter repeated that remediation work was ongoing and asked for others’ thoughts on the intent/meaning of BRs Section 4.9.1.1.
- Renken representative — The reporter said remediation items were expected to be completed shortly.
- Renken representative — The reporter reiterated remediation was ongoing and set a target date of 2022-11-23.
- Renken representative — The reporter said remediation items were completed after updating the gTLD removal alert runbook on 2022-11-23 and asked that the bug be closed.
- Mozilla representative — Mozilla stated they would take a look at closing the bug on Wed 30-Nov-2022 unless there were issues or questions.