Let’s Encrypt: Stopping Issuance for Potential Incident – Resolved(letsencrypt.status.io) |
Let’s Encrypt: Stopping Issuance for Potential Incident – Resolved(letsencrypt.status.io) |
Update: Issuance is back up.
Update: Preliminary incident report:
Uh. I don't know if I like the sound of that...
it is almost always closer to the spelling mistake side than it is the key compromise side of the spectrum.
a peak at https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Progra... will show that most compliance issues, to the general public, are quite mundane.
Let's Encrypt has become one of those pieces of critical Internet infrastructure that just quietly hums away in the background, the fact that they've stopped ALL issuance is deeply concerning.
I don't think the premise behind short lived (six day) certificates being viable is that CA issuance never goes down. Sure, the runway is shorter, but not that short. Most down time is a few hours or less, which is not a problem for six day certificates that should be renewed every three days.
Short lived certificates are optional though, so if it's not worth it to you there are longer lifetime options.
Are they going to be optional forever, or do you plan to eventually get rid of the longer lifetime options?
Somewhere that none of the physical infrastructure/hosting environment overlapped with existing Letsencrypt stuff so that the failure of one entity would have zero blast radius affecting the other.
I know there's a long and complicated process to go through to become a trusted root CA and get your CA public cert auto-installed in every OS and browser trust store. Indeed in the early days of letsencrypt I recall their root CA certs were signed by other older root CAs.
And donation supported no less
Just you wait for the 1 hour and 59 minutes certs! For security!
Actalis offered unlimited single name certificates. Why are ZeroSSL more popular?
Google offered unlimited certificates with multiple names and wild cards. But they required a GCP account seemingly. It would require to give Google personal information, a phone number, and automatic payment permission. And Google not disable your account because your spouse uploaded images for your child's doctor.
All others I saw charged for each certificate.
If this outage breaks your system, that’s entirely on you, not Let’s Encrypt.
Granted if it's configured properly everyone should have 30 days of leeway before having to issue new certs...
Cloudflare does provide the option for customers to manage their own certificates, which would make it the customer’s responsibility to have alternatives issuers when needed.
Then why post? HN is for informed discussion, not every random thought in someone's head.
Certainly the timing is very correlated.
I had chocolate ice cream for breakfast. Certainly the timing is very corrolated [sic].
Unsure if related in any way.
For instance some of the folks who run core BGP at medium to large sized ISPs would revert back to a few legacy IRC channels and find each other to chat and figure out WTF is going on.
"the internet" would still exist, a subset of the application layer stuff that runs on top it wouldn't...
There are all sorts of potential privacy/security issues with any feature built in this area so it would have to be done carefully, but I think useful improvements could easily be made.
In my intentionally absurd theoretical scenario, what would remain up would be the bare metal in colocation in certain service providers' environments...
https://developers.cloudflare.com/ssl/reference/certificate-...
It's absolutely possible to spin up another new CA; lots of folks have done so over the years. But having time, and money, and prior experience all help a lot.
https://zerossl.com/documentation/acme/
Fwiw haven't used them personally
> Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.
https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...
> We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.
They're expressly trying to show that this is a viable approach. It's actually kinda good that this outage, whatever it is, is happening now, as it's giving them a chance to demonstrate (or not) that they can deliver.
At this time! Boil the frog slowly...
Pausing issuance immediately upon discovery of a compliance issue is the absolute correct response so as long as they do their followup appropriately there is absolutely zero risk of being distrusted.
Of course you do, it's the main reason CAs fix compliance issues so fast.
Symantec, WoSign, Entrust, etc repeatedly had non-compliance issues and that led to them being removed (even if fixed)
Here was not a big issue: they forgot a flag to narrow the delegation of trust (but nobody knew that a few hours ago)
Still it can be very problematic, there is a quite similar situation here https://bugzilla.mozilla.org/show_bug.cgi?id=1883843
A basic non-compliance issue, just a web link missing, but huge consequences if they don’t fix it.
Repeated non-compliance (like the Symantec) will eventually get you removed even if fixed.
The core definition of losing “trust” in someone.
Keep in mind that few hours ago, nobody knew what the violation was. Turns out it was an easy fix.
NB: "legal compliance" is another term. So is "{legal,lawful} enforcement"
And once people automate, short-lived certificates are a workable plan B for how to revoke certificates and have the revocation actually work.
These are both reasonable goals.
Seriously? I don't even remember how the letsencrypt auto renew service is called. No idea how I did the initial setup either.