DigiCert: Unrevocation of BT Class 2 CA - G2 CA Certificate
DigiCert reported an incident involving the revocation of the BT Class 2 CA - G2 certificate (serial number 0bdf8169f3686b1c5e8496ba30110e05). DigiCert said it was informed by British Telecom that the BT Class 2 CA - G2 could be revoked, and that VeriSign issued a CRL (CRL Number 00b0) on 6-February-2018 including that serial number. DigiCert then stated that on 8-February-2018 the public tender service of Portugal was not working because many digital-signature certificates used for contracting documents were chained to the revoked BT Class 2 CA - G2. DigiCert attempted to resolve the issue by re-signing an EU-qualified issuing CA with a still-valid, unrevoked intermediate (BT Class 2 CA - G3), but said this failed and that other re-signing approaches were rejected due to the large number of affected smart-card certificates and operational burdens. DigiCert consulted its Policy Authority and, because the revocation had occurred only three days earlier and caused significant burden, decided to remediate the revocation by publishing a new CRL (CRL Number 00b1) that omitted the BT Class 2 CA - G2 serial number. DigiCert also stated it would implement additional steps to increase scrutiny in CA certificate revocation request and approval processes, and later confirmed its CA Revocation Procedure document was updated with additional consent and reconfirmation steps. The bug was marked resolved after the follow-up question was answered.
- VeriSign issued CRL Number 00b0 including the BT Class 2 CA - G2 certificate serial number.
- Portugal tender service reportedly failed due to certificates chained to the revoked BT Class 2 CA - G2.
- DigiCert’s Policy Authority decided to remediate the revocation by publishing a new CRL omitting the BT Class 2 CA - G2 serial number.
- DigiCert confirmed its CA Revocation Procedure document was updated with additional consent and reconfirmation steps.
- Community commenter — DigiCert explained the BT Class 2 CA - G2 revocation incident, the impact on Portugal tender services, the failed re-signing attempt, and the decision to remediate by publishing a new CRL (00b1) omitting the revoked serial number.
- Fastly representative — Asked for more specific information about additional future prevention steps and the timeline.
- Community commenter — Confirmed the CA Revocation Procedure document was updated and implemented, including steps to obtain express written customer consent and reconfirm the intended revocation action.
- Fastly representative — Stated the question was answered and marked the bug resolved.