Certainly: Missing audit log entries for certificates issued during capacity testing
Certainly reported a compliance incident it discovered during its annual WebTrust audit. The issue involves 5,868 certificates issued during planned capacity characterization testing on 2026-04-01 and 2026-04-02 that are missing some or all expected audit log entries. Certainly said the root cause was silent audit-log loss in the host logging pipeline under sustained high-volume issuance, and that database inserts were not affected. All affected certificates had 30-day validity and expired naturally, leaving zero remaining valid. The latest update says the DB-vs-log reconciliation service is deployed to production, alert thresholds were tuned, and the alerts are active but still in a monitoring period before being promoted to paging. The bug remains open and assigned to Certainly.
- During planned capacity characterization testing, audit log loss began under sustained high-volume issuance.
- A second sustained load testing window occurred and additional audit log loss was observed.
- Investigation identified a silent audit-log loss pathway and non-compliance awareness began.
- The transport replacement remediation was deployed to production.
- The DB-vs-log reconciliation service was deployed to production and entered a testing period.
- Fastly representative — Posted a preliminary incident report stating that 5,868 capacity-test-issued certificates are missing expected audit log entries and that Certainly would publish a full incident report by 2026-07-13.
- Fastly representative — Added the full incident report attachment and text, including the impact, timeline, and analysis.
- Fastly representative — Posted a weekly update saying remediation was still on track for 2026-07-30 and the next update would be posted by 2026-07-25.
- Fastly representative — Posted a weekly update showing several remediation action items, with some complete and others in review or in progress, and said the next update would be by 2026-08-01 or upon completion.
- Fastly representative — Posted the 2026-07-30 weekly update stating that five of six action items were complete, the transport replacement was deployed to production, and the DB-vs-log reconciliation service was estimated for 2026-08-06.
- Fastly representative — Posted an update saying the DB-vs-log reconciliation service is deployed to production, the alerts are in a testing period, and expected confirmation is by 2026-08-14.
- Fastly representative — Posted that the DB-vs-log reconciliation service remains deployed, alert thresholds were tuned, and alerts are active but still in a monitoring period before paging.