Let's Encrypt CRL early-removal incident report and closure
Let’s Encrypt self-reported an incident in which monitoring detected that some published CRLs temporarily omitted recently added revocation entries before the affected certificates expired. The thread says the cause was a database replication issue during network instability, and that later CRL updates restored the affected entries. Let’s Encrypt reported that no invalid certificates were produced, issuance was not stopped, and all previously revoked certificates remained revoked. The case then expanded into an audit of Boulder database interactions and a review of other replica-dependent operations that could be affected by replication lag. On 2026-09-22, Let’s Encrypt said its final two action items were complete and that the remediations were finished, including new checks in the CRL creation pipeline. On 2026-10-02, CCADB posted a final call for comments and said the bug would be closed around 2026-10-09.
- A database replication issue caused recently added revocation entries to be temporarily omitted from some CRLs.
- Let’s Encrypt posted a full incident report with impact counts and confirmed that no invalid certificates were produced.
- Let’s Encrypt completed an audit of database interactions and identified several read operations affected by replication lag.
- Let’s Encrypt completed its final action items and filed a report closure summary.
- CCADB issued a final call for comments and said the case would be closed around 2026-10-09.
- Internet Security Research Group — Posted a preliminary self-reported incident report saying crl-monitor detected CRLs temporarily missing recently added revoked serial entries.
- Internet Security Research Group — Posted the full incident report with the timeline, impact counts, and statement that revocations were not delayed.
- Internet Security Research Group — Requested that the Next Update field be set to 2026-07-17 because remediation items were still ongoing.
- Internet Security Research Group — Reported completion of an audit of database interactions and requested setting Next-Update to 2026-09-30.
- Community commenter — Asked follow-up questions about replication lag detection, mitigation timing, the audit findings, and whether fixes would be shared upstream.
- Internet Security Research Group — Answered that stalled replication is already detected, described the audit findings, and said the bad-key-revoker reads from the primary database only.
- Internet Security Research Group — Said the final two action items were complete, linked the resolving change, and filed the report closure summary.
- CCADB representative — Posted a final call for comments or questions and said the report would be closed around 2026-10-09.