Let's Encrypt's 90-minute wobble became 'it's down all day' — its director stepped in
A status-page note about a 90-minute spell of elevated errors got submitted to HN as if Let's Encrypt had been down most of the day. The org's executive director showed up in the thread to walk it back.
Issuance kept working through the incident; upstream networking caused a higher error rate for ~90 minutes, and most requests still succeeded even then. The original HN title implied a day-long outage.
What the thread actually surfaced is the real anxiety underneath: one nonprofit quietly issues TLS certificates for a huge slice of the web, and it's pushing ever-shorter expiry windows that leave less slack when it stumbles.
A 90-minute blip, retold as a day-long outage
The Let's Encrypt status page logged a window of "Degraded Performance," and the story landed on HN under a title implying the certificate authority was effectively down for most of the day. It wasn't. The clarification came from the person who runs the organization behind it:
"Let's Encrypt has been working normally for most of the day. There was a ~90 minute period during which some of our users would have received a higher error rate due to upstream networking issues, but the majority of requests were successful even during that period." — Josh Aas, Executive Director of ISRG
He added that the status.io note was "being misinterpreted as much more severe than [it was] intended to reflect" — written, he said, in response to an earlier submission whose title implied a full-day outage. A reader had already made the same point before him: "Degraded Performance means just that, not 'down.'"
Why a routine blip didn't break the web
The non-disaster has a boring, important cause: well-behaved ACME clients renew certificates early, not at the last minute.
"It's a good thing that acme clients try to renew early, rather than leaving it to the last minute…" — a commenter on why early renewal absorbs short outages
A 90-minute hiccup is invisible to anyone whose cert has weeks of validity left. The damage shows up only where automation is missing — one reader connected it directly to a device on their network: "That explains why one of my IoT vendors is using an expired certificate."
The real worry: one nonprofit, shorter and shorter leashes
The thread's pointed take wasn't about today's errors but about the structural bet the web has made:
"Let's encrypt is a single point of failure for a large percentage of the internet." — a commenter on concentration risk
That anxiety sharpened against Let's Encrypt's own direction of travel toward shorter certificate lifetimes:
"Seems not ideal for an entity who seems to be pushing for shorter expiration periods all the time." — saagarjha
Shorter expiry means renewals happen more often, which means more dependence on the CA being reachable — less slack for exactly this kind of blip. When asked for alternatives, the bar a commenter set says why there's no easy second source: free, open to everyone, automation-friendly, and trusted by every browser and OS. Building another one that clears all four is the actual hard part, not surviving a 90-minute network wobble.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Curbing kids' social media means ID checks for every adult, the thread warns
Australia to Europe, governments are moving to keep under-16s off social media. The catch surfaced in the thread within minutes: the only way to prove a child isn't on a site is to ID every adult on it.