Update: Issuance is back up.
Update: Preliminary incident report:
Uh. I don't know if I like the sound of that...
it is almost always closer to the spelling mistake side than it is the key compromise side of the spectrum.
a peak at https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Progra... will show that most compliance issues, to the general public, are quite mundane.
NB: "legal compliance" is another term. So is "{legal,lawful} enforcement"
Let's Encrypt has become one of those pieces of critical Internet infrastructure that just quietly hums away in the background, the fact that they've stopped ALL issuance is deeply concerning.
I don't think the premise behind short lived (six day) certificates being viable is that CA issuance never goes down. Sure, the runway is shorter, but not that short. Most down time is a few hours or less, which is not a problem for six day certificates that should be renewed every three days.
Short lived certificates are optional though, so if it's not worth it to you there are longer lifetime options.
Somewhere that none of the physical infrastructure/hosting environment overlapped with existing Letsencrypt stuff so that the failure of one entity would have zero blast radius affecting the other.
I know there's a long and complicated process to go through to become a trusted root CA and get your CA public cert auto-installed in every OS and browser trust store. Indeed in the early days of letsencrypt I recall their root CA certs were signed by other older root CAs.
There are all sorts of potential privacy/security issues with any feature built in this area so it would have to be done carefully, but I think useful improvements could easily be made.
And donation supported no less
Just you wait for the 1 hour and 59 minutes certs! For security!
If this outage breaks your system, that’s entirely on you, not Let’s Encrypt.
> Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.
https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...
> We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.
They're expressly trying to show that this is a viable approach. It's actually kinda good that this outage, whatever it is, is happening now, as it's giving them a chance to demonstrate (or not) that they can deliver.
At this time! Boil the frog slowly...
Granted if it's configured properly everyone should have 30 days of leeway before having to issue new certs...
Pausing issuance immediately upon discovery of a compliance issue is the absolute correct response so as long as they do their followup appropriately there is absolutely zero risk of being distrusted.
Of course you do, it's the main reason CAs fix compliance issues so fast.
Symantec, WoSign, Entrust, etc repeatedly had non-compliance issues and that led to them being removed (even if fixed)
Here was not a big issue: they forgot a flag to narrow the delegation of trust (but nobody knew that a few hours ago)
Still it can be very problematic, there is a quite similar situation here https://bugzilla.mozilla.org/show_bug.cgi?id=1883843
A basic non-compliance issue, just a web link missing, but huge consequences if they don’t fix it.
Repeated non-compliance (like the Symantec) will eventually get you removed even if fixed.
The core definition of losing “trust” in someone.
Keep in mind that few hours ago, nobody knew what the violation was. Turns out it was an easy fix.
https://developers.cloudflare.com/ssl/reference/certificate-...
Then why post? HN is for informed discussion, not every random thought in someone's head.
Certainly the timing is very correlated.
I had chocolate ice cream for breakfast. Certainly the timing is very corrolated [sic].
For instance some of the folks who run core BGP at medium to large sized ISPs would revert back to a few legacy IRC channels and find each other to chat and figure out WTF is going on.
"the internet" would still exist, a subset of the application layer stuff that runs on top it wouldn't...
In my intentionally absurd theoretical scenario, what would remain up would be the bare metal in colocation in certain service providers' environments...
Unsure if related in any way.