Let’s Encrypt Halts Certificate Issuance After Cross-Signed Root Certificate Incident

Let’s Encrypt temporarily halted certificate issuance on May 8, 2026 after detecting a critical cross-signed certificate linking its Generation X root to an upcoming Generation Y root; issuance across production and staging was stopped as a precaution, resumed after ~2.5 hours, and all new certificates were rolled back to the Generation X root, affecting the tlsserver and shortlived ACME profiles—administrators are advised to verify renewal chains for certificates issued around this window.