D-TRUST: Delayed revocation of EV certificates
This case concerns D-TRUST’s delayed revocation of EV certificates. D-TRUST became aware on 2019-07-26 that 47 of 89 affected certificates could not be replaced within the required timeframe with new compliant certificates. D-TRUST performed a risk assessment and decided not to revoke the remaining 47 certificates due to urgent customer needs and availability obligations; the revocation deadline would have been 2019-07-27 11:50 UTC. D-TRUST disclosed explanatory statements and scheduled revocation times for the delayed certificates to the community, and reported progress as revocations continued. By 2019-08-30, D-TRUST stated that all 89 affected certificates were revoked. D-TRUST also described remediation steps including ongoing customer communication about short-term certificate exchange and revocation requirements, publishing a notice on its website, revising internal processes to minimize customer influence on revocation timing, and preparing a customer guidance whitepaper (with links later provided). A Fastly participant later stated that remediation appeared complete after reviewing the published whitepaper.
- D-TRUST identified that 47 of 89 affected EV certificates could not be replaced within the required timeframe and assessed revocation timing against customer availability needs.
- D-TRUST reported that all 89 affected certificates had been revoked.
- D-TRUST published a customer guidance whitepaper and provided links to the English and website-hosted versions.
- Bdr representative — Reported that D-TRUST became aware on 2019-07-26 that 47/89 certificates could not be replaced in time, decided not to revoke them within the deadline due to urgent customer needs, and provided a timeline showing revocation progress through 2019-08-30.
- Bdr representative — Gave an update that customer communication was ongoing, expected to finish by end of October 2019, and described plans for periodic customer awareness and a whitepaper.
- Bdr representative — Updated remediation actions: emails and a website notice to customers, continued six-month communications, direct outreach to customers with pinning-related difficulty, internal process revisions, and expected publication of the whitepaper by end of the year.
- Community commenter — Asked Enrico for an update.
- Bdr representative — Stated the whitepaper work was ongoing and still expected to be completed by end of the year.
- Bdr representative — Said the whitepaper was under review and expected publication in January 2020.
- Bdr representative — Announced the whitepaper had been published and provided direct links to the English and website-hosted versions, plus noted a German version.
- Fastly representative — Thanked Enrico and stated that remediation appeared complete after reviewing the whitepaper.