QuoVadis: Failure to revoke certificates with compromised private keys

QuoVadis disclosed a failure to revoke certificates that were found to have compromised private keys. The issue was first reported via email by a third party on March 20, 2020, prompting QuoVadis to investigate and revoke the affected certificates within the required timeframe. Following the incident, QuoVadis implemented improvements to their certificate management system, including the ability to search by SPKI and the establishment of a central blocklist for compromised keys. The case has been resolved, with QuoVadis confirming the successful implementation of these measures.

1. 2020-03-20 QuoVadis received a report of compromised private keys associated with their certificates.
2. 2020-03-21 QuoVadis revoked the affected certificates.
3. 2020-04-16 QuoVadis confirmed the implementation of SPKI searching and rejection of CSRs with compromised keys.
4. 2020-07-29 QuoVadis implemented the ability to check and contribute to DigiCert's central blocklist of compromised keys.

1. 2020-03-24 DigiCert — QuoVadis acknowledged the problem report and committed to investigating and revoking affected certificates.
2. 2020-04-09 DigiCert — Updates on the implementation of SPKI searching and plans for a key blacklist were discussed.
3. 2020-07-29 DigiCert — QuoVadis confirmed the implementation of the central blocklist for compromised keys.