← Certainly LLC cases
Bugzilla #1954889
Certificate Problem Report
Certainly: Early CRL Entry Removal
RESOLVED
INVALID
Certainly LLC
AI Summary
On February 13, 2025, Certainly LLC deployed a version of Boulder that contained a logic bug, leading to the premature removal of some revoked certificates from the Certificate Revocation List (CRL). This incident was identified on March 18, 2025, after a notification from the Let's Encrypt team. Although the bug could have affected a significant number of certificates, further investigation revealed that Certainly's specific configuration prevented any actual compliance issues. The company has since implemented a fix and is enhancing its monitoring systems to prevent similar occurrences in the future.
Chronology
- Upstream commit containing bug in CRL generation code
- Deployed Boulder release containing the bug
- Received notification from Let's Encrypt
- Preliminary incident report published
- Revised evaluation of the incident published
Participants
Wayne Thayer
djeffery@fastly.com
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Certainly: TLS Using ALPN TLS Version and OID
Certainly: Serving Expired OCSP Responses
Certainly: Serving invalid or incomplete CRLs
Certainly: Serving Bad OCSP Responses
Entrust: IP Address in dNSName form
TrustCor: Insufficient Serial Number Entropy
Sectigo: "Some-State" in stateOrProvinceName
IdenTrust: OCSP Outage