DigiCert: Undisclosed CAs - Federated Trust CA-1

This case concerns DigiCert CA certificates that were not disclosed in the Common CA Database (CCADB) as expected. DigiCert said it became aware of the issue while reviewing and updating AIA information for DigiCert Federated ID CA-1 on 9/10/2018, and it referenced that Rob Stradling pointed out the issuing certificate was not yet disclosed on 10/9/2018. DigiCert revoked the relevant certificates at the same time, concluding the issuing CAs were never added to production and that the impact of revocation was negligible. DigiCert also stated it was investigating whether a SHA2 version of the certificate exists and would revoke it if discovered. In subsequent updates, DigiCert reported uploading additional intermediate CA certificates to CCADB and provided Censys.io links for the ICAs it had uploaded, noting that the last 14 listed were revoked on 25-October-2018. The bug was marked RESOLVED with resolution FIXED.

1. 2018-10-09 DigiCert revoked the DigiCert Federated ID CA-1 (SHA1 version) after identifying an issuing certificate that was not yet disclosed.
2. 2018-10-19 DigiCert finalized a list of intermediate CA certificates that needed to be uploaded and/or revoked and began uploading them to CCADB.
3. 2018-10-20 DigiCert uploaded additional intermediate CA certificates to CCADB and provided supporting links and PEMs in an attachment.
4. 2018-10-25 DigiCert revoked the last 14 intermediate CA certificates listed in the Censys.io links.

1. 2018-10-17 DigiCert — Brenda Bernal described how DigiCert discovered the AIA/CCADB disclosure issue and stated that DigiCert revoked the certificates and was investigating for other versions.
2. 2018-10-20 DigiCert — Brenda Bernal attached a PDF related to the October 2018 CA certificate upload and referenced a 10/19 update.
3. 2018-10-20 DigiCert — Brenda Bernal updated the timeline, reported a finalized list of ICAs to upload and/or revoke, and stated that additional ICAs were uploaded to CCADB (including some out of scope).
4. 2018-10-26 Community commenter — Ben Wilson provided Censys.io links for the ICAs mentioned and stated the last 14 were revoked on 25-October-2018.