← Internet Security Research Group cases
Bugzilla #1799755
Certificate Problem Report
Let's Encrypt: End Entity CRLs Not Reissued On Time
RESOLVED
FIXED
Internet Security Research Group
AI Summary
Let's Encrypt experienced a failure to update its Certificate Revocation Lists (CRLs) for approximately 11 days, from October 27 to November 8, 2022. This issue was reported by third parties and was due to configuration errors that prevented the CRL Updater from functioning correctly. During this period, 96,354 revoked certificates were not reflected in the CRLs, although up-to-date revocation status was available via OCSP. The issue was resolved on November 8, 2022, and all remediation items were completed by December 7, 2022.
Chronology
- Last CRL update published.
- CRL updates resumed.
- All remediation items completed.
Participants
J.C. Jones [:jcj]
Sam Harrington
Ryan Dickson
Preston
External References
Similar Local Cases
Let's Encrypt: Potential Denial of Service against websites with broad private key reuse
Let's Encrypt: keyCompromise key blocking deviation from CP/CPS
Let's Encrypt: Expired ISRG Root OCSP X1 Certificate
Let's Encrypt: 302 total OCSP responses available beyond acceptable timelines
Let's Encrypt: Incomplete and Inconsistent CRLs
Let's Encrypt: CRLs Temporarily Missing Revoked Serials
Let's Encrypt: Non-BR-Compliant Certificate Issuance
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours