QuoVadis: failure to reply to CPR in a timely manner

This case involves QuoVadis's failure to respond to a Certificate Problem Report (CPR) in a timely manner, as required by the Baseline Requirements. The report, submitted by a relying party, highlighted potential misissuance of EV certificates categorized incorrectly as 'Non-Commercial Entity.' Despite the initial report being sent on October 20, 2019, QuoVadis did not respond within the stipulated 24-hour timeframe. The issue was compounded by internal email system transitions that led to communication failures. QuoVadis has since acknowledged the oversight and has taken steps to improve their incident response processes.

1. 2019-10-20 CPR submitted by Cynthia Revström to QuoVadis.
2. 2019-10-21 Bugzilla case created due to lack of response.
3. 2019-10-22 QuoVadis acknowledged the failure and began investigating the issue.
4. 2019-10-28 QuoVadis confirmed revocation of misissued certificates.