On May 8, Let's Encrypt halted all certificate issuance for roughly two and a half hours after discovering a problem with the cross-signed certificates bridging its older Generation X root to the newer Generation Y hierarchy — the same rollout covered in our earlier Generation Y story. The cross-certified subordinate CAs were missing an Extended Key Usage (EKU) field that had just become a requirement, breaking the chain for anything issued through the bridge.
What actually happened
Let's Encrypt's status page opened the incident at 18:37 UTC with a single line: issuance was being halted while the cause was investigated. By roughly 21:00 UTC, issuance resumed — but only after rolling the affected profiles (tlsserver and shortlived) back to the older Generation X root entirely, pausing the Generation Y rollout rather than pushing through with a broken chain.
The actual fix took five more days
The operational rollback on May 8 was the fast fix. The real repair — revoking and reissuing the cross-signed intermediates with the correct EKU field included — completed on May 13. No end-entity certificates needed revoking; the problem lived entirely in the intermediates bridging the two root generations, not in anything issued to an actual website.
It cascaded further than self-hosted servers
DigitalOcean opened its own incident less than two hours in, confirming the outage was breaking new certificate issuance for Spaces, Load Balancers, and App Platform custom domains, and causing delays on managed database operations. It's a useful reminder that a single CA's internal certificate-chain problem can ripple through infrastructure layers that never touch an ACME client directly.
Why this matters beyond one bad afternoon
Existing certificates were never at risk — browsers don't re-validate a certificate's chain on every connection, and the break was specifically in newly-issued certificates during the affected window. The real lesson is about margin: as certificate lifetimes keep shrinking (see our renewal guide), a multi-hour CA incident eats a much bigger fraction of a 6-day short-lived certificate's lifespan than it ever did against a 90-day one.
This is our own summary and analysis of publicly reported news, written independently — not a reproduction of any single source's article. Where we reference a specific announcement, we link to it or name the organization directly.