Buypass: Failure to revoke PSD2 QWACs within mandated 5 days

Buypass reported a failure to revoke 16 PSD2 Qualified Website Authentication Certificates (QWACs) within the required 5-day timeframe mandated by the Baseline Requirements. The CA became aware of the issue on March 26, 2020, through an email from a member of the PSD2 community. Following the incident, Buypass implemented a fix and deployed it to production by March 29, 2020. The affected certificates were subsequently revoked on April 4, 2020. The case has been resolved with the CA committing to improve its incident management procedures to prevent future occurrences.

1. 2020-03-26 Buypass received notification of the failure to revoke certificates.
2. 2020-04-04 All affected certificates were revoked.

1. 2020-04-08 Buypass — This is an incident report for a failure to revoke 16 PSD2 QWACs issued by Buypass within the BR mandated 5 days.
2. 2020-05-17 Community commenter — Mads: I appreciate the 'human decision' and that Buypass 'will try to ensure that such important decisions are more thoroughly handled.'
3. 2020-05-26 Buypass — Buypass continuously work to improve procedures and practices for our CA operations including management of incidents.
4. 2020-06-29 Mozilla representative — Mads, I would like to close this bug, but I'm wondering, are there any amendments that you intend to propose for EVGL 9.8.2?
5. 2020-07-16 Buypass — I intend to propose an amendment for EVGL 9.8.2.
6. 2020-08-17 Buypass — We understand that this was incorrect and that we should have made an update.
7. 2020-11-14 Mozilla representative — I will close this bug on or about 20-November-2020 unless there are issues to explore further.