← Asseco Data Systems S.A. cases
Bugzilla #1600158
Certificate Problem Report
Asseco DS / Certum: Failure to revoke intermediate certificates within the BR time period
RESOLVED
FIXED
Asseco Data Systems S.A.
AI Summary
Asseco Data Systems S.A. faced a compliance issue regarding the timely revocation of intermediate certificates. The CA became aware of the problem through discussions on Mozilla's policy forum and took action to revoke the affected certificates within the required seven-day period. Although the revocations were completed on November 26, 2019, the CA acknowledged that their initial response was delayed due to a lack of thorough verification of audit results. The incident involved certificates issued between 2008 and 2014, and the CA has since implemented measures to prevent similar issues in the future.
Chronology
- Mozilla informed about the ALV button on intermediate certificate records.
- CA decided to perform a detailed inspection after ongoing discussions.
- CA completed the analysis and revoked 15 certificates.
Participants
Wojciech Trapczyński
Ryan Sleevi
Wayne Thayer
External References
Similar Local Cases
Asseco DS / Certum: Intermediate CA certificates not listed in audit report
Asseco DS / Certum: inconsistent disclosure of externally-operated intermediate
Asseco DS / Certum: Failure to revoke within 5 days
Asseco DS / Certum: Failure to provide a preliminary report within 24 hours.
Asseco DS / Certum: Unallowed key usage for EC public key (Key Encipherment)
Asseco DS / Certum: Corrupted certificates
Asseco DS / Certum: IP in dnsName
Asseco DS / Certum: commonName not from subjectAltName entries