Let's Encrypt: Gen Y Cross-Certified Subordinate CAs Missing ServerAuth EKU

8 hours ago

Let's Encrypt's Gen Y Cross-Certified Subordinate CAs (YE and YR) issued on September 3rd, 2025, lack the required serverAuth EKU extension, violating CCADB policy effective June 15th, 2025.
The certificates also do not conform to Let's Encrypt's CP/CPS by having an incorrect Subject Organization field ('Let's Encrypt' instead of matching the pre-existing certificate's organization).
Let's Encrypt temporarily disabled issuance and deployed fixes to prevent future issuance from the affected hierarchy, but certificate revocation and CRL generation remain functional.
There is debate over whether end-entity certificates issued under the non-conforming subordinate CAs should be revoked, as they may not align with the CP/CPS-documented hierarchy, though Let's Encrypt asserts they are not misissued and will not be revoked.
The incident report highlights gaps in Let's Encrypt's CP/CPS, which lacks a specific certificate profile for cross-certificates, leading to interpretation disputes about compliance and revocation requirements under BR 4.9.1.1(12).

Hasty Briefsbeta