Lets Encrypt Stopping Issuance for Potential Incident

Website lock panic as Let’s Encrypt hits pause and everyone starts sweating

TLDR: Let’s Encrypt briefly stopped handing out new website security certificates after spotting a possible issue, then brought service back by switching to an older trusted path. Commenters swung between calm caution and full panic, with many saying this shows how scary it is when so much of the web depends on one background service.

For a few tense hours, one of the internet’s quiet workhorses basically yelled “stop everything”. Let’s Encrypt, the free service that helps websites prove they’re legit and keep connections private, halted all new certificate issuing after spotting a possible problem. It later restarted things, saying it had switched back to an older trusted setup while it sorted out a problem tied to a newer one. Translation for normal humans: the machine that hands out website security badges had a scare, and the internet immediately went into doom-scroll mode.

The comments were where the real pulse check happened. One camp went straight to full disaster movie energy, with people openly praying this wasn’t “another security nightmare” or, worse, some kind of key compromise that could ripple across huge chunks of the web. Since so many sites rely on Let’s Encrypt, commenters treated it like hearing the power grid had made a weird noise. Others zoomed in on the delicious irony: the push toward ever-shorter certificate lifetimes suddenly looked a lot less clever when the renewal machine itself hiccups. One user basically summed up the mood of anyone using those brand-new super short certificates: “getting a bit sweaty right now.”

There was also some classic internet detective work, with people side-eyeing separate issues at Discord, Cloudflare, and elsewhere and wondering if this was all one giant mystery thread. No proof, just vibes — but very strong vibes. The funniest running theme? Let’s Encrypt is usually invisible, humming along in the background, and the second it blinks, everyone remembers just how much of the modern web is balanced on this one very unglamorous piece of infrastructure.

Key Points

  • Let's Encrypt temporarily shut down all certificate issuance after becoming aware of a potential incident.
  • Affected components included production and staging ACME API endpoints and portal services.
  • Issuance later resumed after Let's Encrypt identified an issue with the cross-signed certificate from its Generation X root to its new Generation Y root.
  • To restore service, all issuance was switched back to the Generation X root certificate.
  • The change specifically affects the "tlsserver" and "shortlived" ACME certificate profiles.

Hottest takes

"not another security nightmare" — noplacelikehome
"anyone with a short-lived cert is getting a bit sweaty right now" — mark_round
"one little-discussed down side to ever shorter-lived certificates" — mcherm
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.