Re: Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours

2020-03-30 Thread Josh Aas via dev-security-policy
On Monday, March 30, 2020 at 4:48:38 PM UTC-4, Josh Aas wrote: > On Thursday, March 26, 2020 at 6:27:10 PM UTC-4, Ryan Sleevi wrote: > > Apologies for the delay here. I filed > > https://bugzilla.mozilla.org/show_bug.cgi?id=1625322 for this. > > We are looking into this. > > Matt - It would be he

Re: Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours

2020-03-30 Thread Josh Aas via dev-security-policy
On Thursday, March 26, 2020 at 6:27:10 PM UTC-4, Ryan Sleevi wrote: > Apologies for the delay here. I filed > https://bugzilla.mozilla.org/show_bug.cgi?id=1625322 for this. We are looking into this. Matt - It would be helpful if you could report issues like this to the CA in question, not just t

2019.08.20 Let’s Encrypt Incident: Incorrect OCSP responses under certain conditions

2019-08-26 Thread Josh Aas via dev-security-policy
On 2019.08.20 at 08:48 UTC we received a report from community member and Apache httpd developer, Stefan Eissing, that under certain conditions our OCSP caching layer would return a valid OCSP response but not the one that was requested. This resulted in our OCSP service acting in violation of R