2023.06.15 Certificate Policies Extension Mismatch

Incidents
1

On 2023-06-15, Let’s Encrypt updated our subscriber certificate profile to remove the ISRG CPS OID and URL from the Certificate Policies extension. While this change was being deployed, it was possible for a single ACME Order Finalization flow to produce a precertificate and final certificate with the same serial number but different contents in this extension.

Out of an abundance of caution we halted issuance while we investigated the issue. Once we confirmed that the issue was transient and occurred only during the deploy, we resumed issuance.

We have identified a preliminary set of 645 affected serial numbers. We are in the process of confirming the affected certificates and developing remediations to prevent similar incidents from happening in the future. We will revoke the affected certificates within 5 days.

Please follow along for full details on Bugzilla.

17 Likes
2

As of 22:43 UTC on 15 June 2023, our ARI endpoint identified affected certificates for immediate renewal.

For more information about ARI, see draft-ietf-acme-ari-01 and Improving Resiliency and Reliability for Let’s Encrypt with ARI - Let's Encrypt

14 Likes
3

We have decided our revocation time and have sent notification emails to any affected subscribers who provided contact information.

We will revoke the affected certificates on Monday 19 June 2023 at 18:00 UTC. This gives affected subscribers a bit of time to react to notification emails, or for their ACME clients to automatically renew in response to ARI information in our API.

9 Likes
4

The affected certificates have been revoked as of 18:00 UTC

8 Likes
5

The full incident report has been posted.

11 Likes