QuoVadis: Unconstrained CAs revocation
This case concerns QuoVadis subCAs that were not revoked within the seven days allowed by the BR section .4.9.1.2, as previously disclosed in Bug 1581597. The CA stated it became aware of the issue through its prior disclosure and referenced Ryan Sleevi’s 15 Nov note on revocation expectations for such subCAs. QuoVadis reported that it committed to revoke the CAs on a schedule outlined in Bug 1581597 and requested that all 18 subCAs be added to OneCRL; it also stated that seven of the 18 subCAs had already been revoked and that additional revocations were planned. The CA further stated that COVID-19 access restrictions complicated bringing external auditors in, and that after restrictions were lifted it proceeded to complete revocation and key destruction of the final two ICAs during the week of June 22, with termination reported on June 25. The bug was later requested to be closed after the parent bug was marked resolved, and the final comment indicates there was no further update other than a request to close once revocation or key destruction was completed. The bug’s resolution is listed as FIXED and the current status is RESOLVED.
- Mozilla CA Program expectations for revocation of unconstrained subCAs were noted in mozilla.dev.security.policy.
- QuoVadis opened this CA Program bug describing the unconstrained subCA revocation issue.
- QuoVadis reported termination of the final two of the 18 subCAs addressed in this bug.
- DigiCert — Opened the bug with details referencing Bug 1581597, stating the 18 unconstrained subCAs were not revoked within the BR seven-day period and describing planned remediation including OneCRL addition and revocation scheduling.
- DigiCert — Reported that 10 of 12 CAs were revoked and that the remaining two were scheduled for revocation on 31 March 2020.
- DigiCert — Stated closure depended on bringing external auditors in and that COVID-19 access restrictions delayed progress, with expected additional information during the week of May 25.
- DigiCert — Reported access restrictions were unchanged and that an update would be provided during the week of June 8.
- DigiCert — Reported COVID-19 access restrictions were lifted and that plans were proceeding to complete revocation and key destruction during the week of June 22.
- DigiCert — Reported the final two of 18 subCAs were terminated on June 25 and pointed to the parent bug for details.
- DigiCert — Pointed to the parent bug for information regarding an auditor report validating key destruction procedures for 'QuoVadis Issuing CA G4'.
- DigiCert — Noted the parent bug was marked resolved and asked whether this bug could be marked resolved as well.
- DigiCert — Requested closure as revocation or key destruction of the referenced CAs was completed, with no additional updates.