QuoVadis: failure to reply to CPR in a timely manner

This case involves QuoVadis's failure to respond to a Certificate Problem Report (CPR) within the required 24-hour timeframe as stipulated by the CA/Browser Forum Baseline Requirements. The issue was raised by a relying party, Cynthia Revström, who reported potential misissuance of EV certificates. QuoVadis acknowledged the delay and attributed it to a mix-up in their email systems. They have since confirmed the revocation of the misissued certificates and are investigating the broader implications of the miscategorization of 'Non-Commercial Entity' in their EV certificate issuance. The case has been resolved with QuoVadis committing to improve their incident response processes.

1. 2019-10-20 Cynthia Revström submitted a CPR to QuoVadis.
2. 2019-10-21 QuoVadis acknowledged the delay in response and began an investigation.
3. 2019-10-22 QuoVadis confirmed the revocation of the misissued certificates.

1. 2019-10-21 Cynthia representative — Reported failure to receive a timely response to the CPR.
2. 2019-10-21 DigiCert — Acknowledged the delay and stated that the report was received and responded to, but the response was not delivered.
3. 2019-10-22 DigiCert — Confirmed the revocation of the misissued certificates and ongoing investigation.