Let's Encrypt root CRLs omitted required reasonCode on revoked subordinate CA entries

This case concerns Let's Encrypt's publication of root CRLs that omitted the required revocation reasonCode for entries revoking the Cross-Certified Subordinate CA Certificates of ISRG Root X2, Root YR, and Root YE. The issue was introduced by a bug in the ceremony tool, which was configured to use the reason code "superseded" but omitted the reasonCode entry extension instead. Let's Encrypt said only two CRLs were impacted, both issued as part of manual ceremonies, and that the incident was contained. The thread states that no certificates were invalidated and that no revocations were delayed. Let's Encrypt filed a preliminary incident report, later followed by a full incident report with timeline, impact, and remediation details. The latest comment says they are still working on open action items and requested the next-update field be set to 2026-11-13.

1. 2026-05-13 Affected root CRLs were issued during a manual ceremony without the required reasonCode on revoked subordinate CA entries.
2. 2026-09-23 Let's Encrypt received an external report via its certificate problem reporting address and confirmed the compliance problem.
3. 2026-10-06 Let's Encrypt posted a full incident report with timeline, impact, and remediation details.
4. 2026-11-04 Planned replacement CRLs are to be issued as part of a ceremony.

1. 2026-09-23 Internet Security Research Group — Opened the bug with a preliminary incident report describing the missing reasonCode on revoked subordinate CA entries in root CRLs.
2. 2026-10-06 Internet Security Research Group — Posted the full incident report, including the non-compliance dates, impact, timeline, and related references.
3. 2026-10-13 Internet Security Research Group — Said the team was still working on open action items and requested the next-update field be set to 2026-11-13.