DigiCert / ABB: greater than 825 day cert issuance
This case concerns DigiCert’s SubCA ABB issuing a certificate with a lifespan greater than 825 days. DigiCert became aware after being notified by Alex Gaynor on 2018-03-16 that ABB had issued a certificate valid for 30 months, after a ballot change taking effect on 2018-03-01. DigiCert contacted ABB on 2018-03-16 requiring revocation, and ABB revoked the certificate on 2018-03-16, with the revocation occurring just over six hours after DigiCert’s awareness. DigiCert stated that ABB stopped issuing certificates as of 2018-03-19 and that the issue was attributed to a lack of communication to subCAs about the lifespan rule change. DigiCert reported sending reinforcing notices to all subCAs and described additional controls, including requiring ABB to disable certificate templates in its issuing system and completing a contract amendment to stop further issuance with penalties. A participant later indicated “Actions completed, resolving,” and the bug is marked RESOLVED with resolution FIXED.
- ABB mis-issued a certificate valid for 30 months (greater than 825 days).
- DigiCert was notified of the mis-issuance and ABB revoked the certificate the same day.
- ABB stopped issuing certificates.
- Thread participants indicated actions were completed and the case could be resolved.
- DigiCert — Brenda Bernal described how DigiCert learned of the issue, provided a timeline, stated ABB stopped issuing as of 2018-03-19, and outlined remediation steps and controls.
- Fastly representative — Wayne Thayer asked what assurance existed that the issue would not recur and requested the timeline/status of ABB’s move to the managed CA service.
- DigiCert — Brenda responded that ABB would provide proof templates were disabled on 2018-03-19, described contract amendment controls, and stated ABB had an active validated account in the managed service as of March 28, 2018 with no new issuance off ABB’s OmniRoot platform.
- Fastly representative — Wayne Thayer wrote “Actions completed, resolving.”