Störungsverlauf von Smarty

SUMMARY We are rotating the Let's Encrypt intermediate certificates used to issue the TLS certificates that secure our services. Our certificates will continue to chain to the same trusted root — ISRG Root X1 — but through Let's Encrypt's new "Generation Y" intermediate hierarchy. For the vast majority of customers, no action is required. If your systems validate our certificates against the public root store — the default for virtually all browsers, operating systems, and HTTP client libraries — this change is completely transparent. The only customers who may be affected are those who pin a specific Let's Encrypt intermediate certificate. WHY WE'RE MAKING THIS CHANGE The intermediate certificates currently in our chain are approaching the end of their lifecycle, with the existing intermediate path expiring in approximately nine months. Rotating well ahead of that deadline guarantees uninterrupted certificate issuance and renewal with no disruption to your integrations. THE CHAIN OF TRUST A TLS certificate is never validated on its own. It is verified through a chain that links the connection back to a root certificate your device already trusts. Today, our certificates chain like this: Your connection → Smarty leaf certificate → Let's Encrypt intermediate → ISRG Root X1 After this update, they will chain like this: Your connection → Smarty leaf certificate → Let's Encrypt Generation Y intermediate (YR / YE) → ISRG Root YR / YE → ISRG Root X1 (via cross-sign) The destination is unchanged. Both the old and new paths terminate at ISRG Root X1, the RSA root that ships in every current major trust store. Let's Encrypt cross-signed its new Generation Y roots with the existing X1 and X2 roots specifically so that anything already trusting X1 continues to work without modification. The path is longer; the anchor of trust is identical.

At 00:00 UTC on April 17, A scheduled certificate renewal updated the CA chain served by api.smartystreets.com. The change was made without advance notice to integrators, and the new chain is anchored by Sectigo roots (USERTrust ECC Certification Authority and USERTrust RSA Certification Authority) that are not present in some older trust stores. Clients on current operating systems, browsers, and runtimes continue to work without change. Connections may fail for systems that: - Use a custom or pinned TLS trust bundle that does not include USERTrust ECC Certification Authority. - Run Java 8 installations predating update 51 (mid-2015) or earlier Java versions — these do not ship USERTrust ECC Certification Authority in the default cacerts keystore. - Run other environments with outdated trust stores, including older Android devices, legacy embedded and IoT hardware, and air-gapped systems. To restore connectivity, affected systems should either update to a current runtime or add the Sectigo roots (USERTrust ECC Certification Authority and USERTrust RSA Certification Authority) to their trust store. Please reach out to support for assistance.

Around 22:00 UTC the US [Address] Autocomplete Pro API service in one of our datacenters went offline due to a misconfiguration. The problem was quickly identified and rectified. All other datacenters were unaffected.

We are currently investigating an increase in 503 Service Unavailable errors. We will provide an update as soon as more information is available.

The issue has been identified and we are currently monitoring overall system health.

The issue has been resolved. A small number of nodes experienced large memory consumption which resulted in a few 503 errors being returned. This has been resolved and measures have been put in place to mitigate this in the future. Additional alerts and monitors have also been put in place.

Around 19:15 UTC an incorrect configuration was deploy to our US Extract API service. The problem was quickly detected and reverted.

We've identified an issue affecting one of our redundant facilities. As a precaution, it has been taken out of active rotation while we investigate.

This incident has been resolved.

During a routine data deployment, we noticed a brief spike in 5xx error responses. Systems have since stabilized, and we're investigating the root cause to confirm the issue is fully resolved and to prevent similar behavior in future deployments.

This incident has been resolved.

We have become aware that Google services have been exhibiting some intermittent failures. As a result, anyone using "Login with Google" to access their account dashboard on our website may also experience a failure to login. When Google is able to resolve the issues they are having, the login will continue to work as normal. In the meantime, if you have created a username and password, you should be able to use those to login.

We discovered that the "API Keys" page in our Account dashboard web site was not able to retrieve the lists of keys from the backend service. This has now been fixed.

Around 19:10 UTC, increased traffic exposed resource limitations caused by a previously implemented algorithm update, leading to issues on several servers hosting some of our services (US Street API, US Extract API) in one of our data centers due to insufficient RAM. To ensure stability and service reliability, the affected servers have been decommissioned and replaced with upgraded hardware.

The US Enrichment API intermittently returned HTTP 500 codes in a single data center on 2025 February 26 around 17:00 UTC. The issue has been resolved as of 17:35 UTC.

Around 18:00 UTC, one of our facilities experienced a network routing issue that lasted for about 30 minutes. The facility was removed from DNS rotation until the network issue had been resolved. If you have not yet read through our "Technical Requirements" and "Best Practices" documentation, this could be a good opportunity to become familiar with those important and helpful documents. - https://www.smarty.com/docs/cloud/requirements#retry - https://www.smarty.com/docs/cloud/best-practices

From 01/08 12pm UTC to 01/09 9am UTC some requests to the US Street [Address] API instances experienced an intermittent issue with certain malformed addresses that caused some requests to not get a response, returning HTTP 503 errors to those requests. This affected a small number of requests and the error has since been resolved.

During a regular upgrade of our control plane, several controller nodes became unresponsive. This resulted in various routing issues which were manifest by intermittent HTTP 503 errors visible in the HTTP response to some callers. Our monitoring systems alerted our Operations Engineering Team of the anomaly and, as a result, the affected cluster, located in our US Central region (Chicago), was immediately removed from production rotation. The affected cluster has been restored to full health by provisioning new cloud resources using our IaC (infrastructure as code) systems. Following this, the cluster was confirmed to be was healthy via our automated monitoring and was subsequently re-introduced into active rotation.

On 2024 December 19, around 22-24:00 UTC, some users may have received the HTTP 299 code in response to requests from one of our loadbalancers. The reason for this response has been identified and remediated. We would like to take this opportunity to remind our users to familiarize themselves with our best practices. https://www.smarty.com/docs/cloud/best-practices

Around 15:00 (3pm) UTC on 2024 November 28, a single IP address at one of our datacenters experienced a routing issue that caused some requests to be "null routed", which may have resulted in some clients experiencing 500 level errors during that time. This issue persisted until 17:00 (5pm) UTC on 2024 November 28, at which time our upstream provider resolved the issue. Our recommendation to clients to mitigate an issue such as this in the future is to maintain a pool of active TCP connections to the server nodes and to only send traffic over active, healthy TCP connections. Then a background "thread" (or programmatic equivalent) could attempt to connect to the suspect IPv4 address. Once that connection has determined to be healthy, regular traffic can be resumed over that TCP connection.

As previously announced, JSONP support in US Autocomplete Pro API is being removed today. See previous announcements: - https://status.smarty.com/incidents/hftb2zdrfn3q - https://status.smarty.com/incidents/m8pc40fcq3c5

No. We have evaluated our systems and determined that we are not at risk.

A configuration change to an older version of International Address Autocomplete API caused a few users to receive inaccurate 402 responses. The configuration was identified and rectified. Users of the older version of this API should no longer be receiving the erroneous response. Users of the new version of the API were unaffected.

Some modifications were made to TLS certification configurations on one of our load-balancers. Part of the modification adjusted the order in which certificates were presented to clients. Older applications that are unable to properly use Server Name Indication may have been affected adversely by this change. In order to continue supporting older clients, the certificate order was readjusted to maximize compatibility. We suggest updating any applications that call Smarty APIs to be compatible with modern TLS certificate usage. We also suggest ensuring that the hostnames being used in requests to our APIs are current. Hostnames can be found on the documentation pages for the products that you are using. (https://www.smarty.com/docs/cloud)