QuoVadis: Failure to revoke certificates with compromised private keys

QuoVadis faced a significant incident involving the failure to revoke certificates that were issued with compromised private keys. The issue was first reported on March 20, 2020, leading to a series of actions including the revocation of affected certificates within 24 hours. Challenges included the inability to search by SPKI in their systems, which delayed the identification of all compromised certificates. Improvements have since been implemented, including enhanced searching capabilities and the establishment of a central blocklist for compromised keys. The case was resolved with the confirmation that necessary measures were taken to prevent future occurrences.

1. 2020-03-20 Initial report of compromised keys received.
2. 2020-03-21 Affected certificates were revoked.
3. 2020-04-09 SPKI searching capability implemented.
4. 2020-07-29 Integration with DigiCert's central blocklist completed.