DigiCert CAA checking issue caused issuance when the internal CAA service was unreachable

DigiCert reported that its internal CAA record checking service had a bug that allowed certificate issuance when the service was unreachable and timed out. DigiCert said QA discovered the issue on 2019-04-29 while testing another feature, and the same-day fix changed issuance so requests are rejected if no response is received from the CAA checking service. The incident report stated that 1053 certificates were issued without checking CAA records between 2017-09-09 and 2019-04-16, and that 16 of those would fail CAA checks if re-issued today. DigiCert later said it would revoke all impacted certificates except a small number used on critical infrastructure where the domain operator confirmed no CAA record existed at issuance and none exists now. The thread also records follow-up remediation, including training, added alerts, unit tests, and additional checks to confirm CAA checks are performed and recorded. The bug was eventually marked RESOLVED/FIXED, and DigiCert later asked for the bug to be closed.

1. 2017-09-07 CAA checking requirement was in effect
2. 2017-09-09 First affected certificate was issued without checking CAA records
3. 2019-04-16 Last affected certificate was issued without checking CAA records
4. 2019-04-29 DigiCert QA discovered the CAA timeout issue and applied a fix the same day
5. 2019-05-01 DigiCert generated a report identifying 1053 affected certificates
6. 2019-05-14 DigiCert said it would revoke nearly all impacted certificates, with limited exceptions for critical infrastructure
7. 2019-11-12 DigiCert said the rollout had completed and the bug could be closed

1. 2019-05-10 DigiCert — Opened the bug with an incident report describing the CAA timeout issue, the affected certificate count, and the initial remediation steps.
2. 2019-05-10 Fastly representative — Asked for clarification on how the affected count was determined, whether the 16 certificates were still valid, and why the root cause analysis lacked detail.
3. 2019-05-10 DigiCert — Confirmed the count came from logs, said the 16 certificates were still valid, and explained that DigiCert only checked CAA prior to issuance.
4. 2019-05-14 DigiCert — Clarified that the code review had occurred but the reviewer misunderstood the CAA requirements, and said DigiCert would revoke nearly all impacted certificates.
5. 2019-05-31 DigiCert — Posted a revised incident report and additional remediation steps, including training, alerts, and new tests.
6. 2019-07-11 DigiCert — Provided a timeline for the planned remediation items, including completion dates for the new checks.
7. 2019-08-15 DigiCert — Confirmed that remediation items #2 and #3 had been deployed.
8. 2019-10-01 DigiCert — Said redundant checks were in place and the APIs were done, with integration still pending.
9. 2019-11-12 DigiCert — Said the rollout had completed and the bug could be closed.
10. 2020-04-01 DigiCert — Requested that the bug be closed if there were no further questions.