SwissSign: failure to provide a preliminary report within 24 hours
This case concerns SwissSign’s failure to provide a preliminary report within 24 hours after a certificate problem report was submitted to SwissSign’s CPS address (i**********o@swisssign.com). The reporter stated that the email was accepted by SwissSign’s mail server on 2020-05-06 12:16 UTC, but that no preliminary report had been received 24 hours later. SwissSign explained that the message was classified as potentially malicious/spam and that the attached PEM file was identified as a potential threat by its cloud-based malware/spam protection, so the responsible team did not receive the report in time. SwissSign said it was investigating and later found the mail in quarantine, and that it had no knowledge of the report earlier. For mitigation, SwissSign decided to activate quarantine-notifications for the i**********o@swisssign.com mailbox to trigger a manual check for legitimate problem reports. SwissSign also stated that it checked quarantined mails (retention 90 days) and found no indication of another report being categorized as spam/phishing in the past. Mozilla indicated an intention to close the bug as Fixed.
- A certificate problem report email was sent to SwissSign’s CPS address and was accepted by SwissSign’s mail server but later classified as potentially malicious/spam and placed in quarantine.
- The Bugzilla case was opened after the reporter did not receive a preliminary report within 24 hours.
- SwissSign reported that the message was found in quarantine and that the attached PEM file was identified as a potential threat; SwissSign began responding in the bug.
- SwissSign reported mitigation steps (quarantine notifications triggering manual checks) and stated it found no prior blocked reports in quarantined mail (90-day retention).
- Mozilla stated an intention to close the bug as Fixed.
- Mm representative — Reported that an email sent on 2020-05-06 to i**********o@swisssign.com was accepted but that no preliminary report was received within 24 hours.
- SwissSign AG — Requested assignment of the bug to him.
- SwissSign AG — Provided a timeline and stated the message was classified as potentially malicious/spam and found in quarantine; said the attached PEM file was identified as a potential threat and described mitigation steps.
- Hezmatt representative — Asked multiple questions about SwissSign’s threat-protection configuration, logging history, and how valid reports might be identified and processed if blocked.
- SwissSign AG — Stated no prior blocked reports were found in quarantined mails (90-day retention) and described mitigation via quarantine-notifications for manual checks.
- Hezmatt representative — Asked to fully answer the earlier questions.
- Community commenter — Commented on the ambiguity of Mozilla policy about who can ask questions and whether the CA must answer them.
- Mozilla representative — Suggested it would be good to know whether SwissSign could reconfigure its mail filter so alerts arrive to the appropriate personnel.
- SwissSign AG — Confirmed that quarantined mails now trigger notifications to the responsible team for manual identification of legitimate problem reports.
- Mozilla representative — Stated an intention to close the bug as Fixed.