Certainly LLC: Expired certificates on BR §2.2 test websites; incident report closed after remediation
Certainly LLC self-reported that its BR §2.2 test websites served expired certificates on the “valid” and “revoked” pages after the certificates expired on 2026-06-08 and were not renewed for 23 days. The report said the issue was caused by an unpinned upstream dependency that introduced a breaking CLI change, together with a monitoring misconfiguration that suppressed TLS validation alerts. Certainly stated there was no misissuance and that certificate issuance, revocation, and CRL services were unaffected; the problem was limited to the availability and correctness of the test websites. The company reported that all remediation action items were completed, including pinning the dependency, fixing monitoring, adding expiry pre-alerting, and decommissioning the legacy monitoring tool. The thread then moved to closure, with CCADB posting a final call for comments and the report closure summary stating that all disclosed action items were complete and closure was requested. The bug is now RESOLVED/FIXED.
- BR §2.2 test website certificates expired and the “valid” and “revoked” sites presented expired certificates for 23 days.
- Emergency change deployed; all six BR §2.2 test website certificates were re-issued and sites restored/verified externally.
- All five remediation action items were completed, including migration to configuration-as-code monitoring and decommissioning the legacy tool.
- Fastly representative — Filed a full incident report describing expired certificates on the “valid” and “revoked” test sites, attributing it to an unpinned upstream dependency breaking change plus suppressed monitoring alerts, and stating an emergency fix re-issued all six certificates on 2026-07-02.
- Fastly representative — Provided a weekly update that the external monitor configuration audit was completed and the monitoring migration and expiry pre-alerting work remained in progress.
- Fastly representative — Posted a weekly update stating remediation remained on track for the 2026-07-31 date.
- Fastly representative — Reported that all action items were complete except decommissioning the legacy monitoring tool, and that the configuration-as-code replacement was deployed with alerting operational.
- Fastly representative — Submitted a closure summary stating all disclosed action items were complete and requesting closure of the incident report.
- CCADB representative — Posted a final call for comments or questions and said the incident report would be closed around 2026-08-07.