DigiCert: SCEE / Justica non-BR-compliant certificate issuance — incident report and remediation
This case concerns DigiCert’s incident report related to certificates issued under the SCEE / EC Raiz Estado ("Portuguese Root") and the Justica subordinate CA that chain through a cross-signing to the DigiCert Baltimore CyberTrust root. The issue was triggered by external reporting in Bug 1432608 describing a large number of technical compliance issues with certificates issued by the ECCE 001 subordinate CA operated by SCEE / EC Raiz Estado and additional technical compliance issues with the Justica subordinate. DigiCert stated it became aware of the problem when Jonathan Rudenberg posted to Bug 1432608 and that it then worked to address the issues identified in the incident report. DigiCert described actions taken with the Portuguese government, including revocation of the CA certificate issued to Justiça on 2018-02-02. DigiCert also indicated it intended to revoke the cross certificates issued to the Portuguese Root and later reported that CCADB was updated with four revocations completed on 2018-08-21, with a one-week extension to support certificate replacement for critical services. The bug thread concludes with confirmation that the four ECRaizEstado cross-certificates signed by the Baltimore CyberTrust root are marked as revoked in CCADB and will be added to OneCRL, removing trust in ECRaizEstado from Mozilla products. The bug is resolved as FIXED.
- The Portuguese Root CA revoked the CA certificate issued to Justiça.
- DigiCert completed revocation of four ECRaizEstado cross-certificates and updated CCADB.
- Community commenter — Requested an incident report and described the technical compliance issues cited in Bug 1432608, asking for an incident report per Mozilla’s misissuance instructions.
- Community commenter — Posted a detailed incident report describing how DigiCert became aware of the problem and the timeline of remediation actions with the Portuguese government, including revocation steps.
- Community commenter — Asked whether DigiCert planned to revoke all four EC Raiz Estado cross-certificates on 2018-08-14 and to mark them revoked in CCADB for OneCRL inclusion.
- Community commenter — Reported that CCADB was updated with the four revocations completed the previous day and noted a one-week extension for certificate replacement.
- Community commenter — Confirmed the four ECRaizEstado cross-certificates are marked revoked in CCADB and will be added to OneCRL, removing trust in ECRaizEstado from Mozilla products.