DigiCert: Issuance of Cert with Compromised Key

DigiCert reported a compliance issue involving the issuance of certificates with a compromised key. The problem was identified during an escape analysis following a SEV1 incident. A total of 123 OV and 36 EV certificates were mis-issued due to a failure in the domain validation process. DigiCert revoked all impacted certificates within 24 hours of identifying the issue. They have since implemented a blacklist system to prevent the issuance of certificates using compromised keys and are working on further automation to enhance their processes.

1. 2019-11-04 A SEV1 outage was reported for a storefront.
2. 2019-11-07 The problem was discovered during an escape analysis.
3. 2019-11-12 All impacted certificates were revoked.
4. 2020-07-20 DigiCert confirmed the blacklist tool is live and operational.

1. 2020-03-24 DigiCert — DigiCert disclosed the mis-issuance of certificates with a compromised key and detailed the timeline of events.
2. 2020-03-24 Fastly representative — Inquired about the relationship between this incident and another bug report.
3. 2020-07-20 DigiCert — Provided an example of the blacklist checker successfully blocking a new certificate issuance with a compromised key.
4. 2020-07-20 Mozilla representative — Requested confirmation of the blacklist checker’s functionality before closing the bug.