DigiCert: Underscores - Canadian Imperial Bank of Commerce

This case concerns DigiCert certificates containing underscore characters for Canadian Imperial Bank of Commerce (CIBC) and the need to revoke those certificates within the CAB Forum–related timeline. The issue was raised by browsers on the CA/Browser Forum on September 5, 2018, and DigiCert later ceased issuance of underscore characters on October 1, 2018. DigiCert notified customers and engaged in discussions about potential impact, and the thread describes a revocation requirement becoming known during the CAB Forum ballot process. CIBC reported that it could replace the certificates but requested more time because it needed to modify applications and infrastructure and complete change-management testing, asking that underscore certificates not be revoked until February 28, 2019. DigiCert confirmed that an incident had occurred and stated a planned extension to revoke the remaining certificates on February 28, 2019, with periodic updates. The thread’s final update states that all remaining underscore certificates either expired or were revoked.

1. 2018-09-05 Browsers raised an issue on the CA/Browser Forum regarding underscore characters.
2. 2018-10-01 DigiCert ceased issuance of underscore characters.
3. 2019-01-18 DigiCert confirmed an incident and planned an extension to revoke remaining underscore certificates to 2019-02-28.
4. 2019-02-26 All remaining underscore certificates either expired or were revoked.

1. 2019-01-10 DigiCert — CIBC provided input that it needed more time to replace underscore certificates due to required application/infrastructure changes and requested revocation be delayed until 2019-02-28.
2. 2019-01-14 Community commenter — Ryan asked what led to the change in evaluation of revocation timelines and risk.
3. 2019-01-14 DigiCert — Brenda responded that the customer was targeting replacement by January month-end and requested sufficient time to address issues and ensure successful implementation before 2019-02-28.
4. 2019-01-17 Community commenter — Ryan asked Brenda to confirm whether an incident occurred and that affected-certificate details were accurate.
5. 2019-01-18 DigiCert — Brenda confirmed an incident occurred, stated the planned extension to revoke remaining certificates to 2019-02-28, and said periodic updates would be provided.
6. 2019-02-26 DigiCert — Brenda reported that all remaining underscore certificates had either expired or were revoked.