DigiCert: Onion Certs
This case concerns DigiCert issuing “onion certs” that lacked a required Tor descriptor. DigiCert said it became aware of the problem via an email from Alex Cohen on March 9, 2018, and reported to Mozilla. In response, DigiCert revoked the impacted certificates on March 10, 2018, scanned its database for additional certificates, and revoked any additional ones identified by March 12, 2018. DigiCert also added error handling to detect when a Tor descriptor is missing and stated it stopped issuing onion certs that lack a descriptor. DigiCert explained the underlying cause as an incorrect implementation of the ballot, including missing backend and front-end checks requiring a Tor descriptor, and insufficient training for the Tor descriptor requirement. The bug was resolved as FIXED after DigiCert stated that all remediation work was completed, including adding technical controls, revoking certificates issued after the effective date of the new ballot, and adding staff training.
- DigiCert received an email from Alex Cohen about impacted onion certificates.
- DigiCert revoked the impacted certificates.
- DigiCert scanned its database for additional certificates and revoked any identified.
- DigiCert added error handling to detect missing Tor descriptors.
- DigiCert reported remediation completion, including technical controls and additional training.
- DigiCert — Filed the bug describing the issue, revocation and scanning actions, added error handling, and planned additional checks for Tor descriptors per onion name.
- Fastly representative — Asked for an update when technical controls were in place and for a completion date if delayed.
- Fastly representative — Asked whether the remediation work described in the bug had been completed.
- DigiCert — Confirmed remediation completion, stating technical controls were added, all certificates issued after the effective date of the new ballot were revoked, and staff training was added.