GlobalSign: Failure to revoke key-compromised certificate within 24 hours

This case concerns GlobalSign’s revocation of certificates after a certificate problem report stated that a private key associated with a specific SPKI had been compromised. The report was delivered at 2020-05-12 06:41:41 UTC and requested revocation of all certificates issued using that SPKI. GlobalSign effected revocation at 2020-05-13 06:59:55 UTC, but the expected outcome in the report was revocation within 24 hours of the certificate problem report being sent. GlobalSign attributed the delay to a timezone confusion in its case management system: an operator assumed times were displayed in GMT+01:00 while the system was displaying GMT+02:00, causing the internal revocation deadline to be set too late. GlobalSign stated it reviewed compliance operator profiles and changed account time display settings to GMT+01:00, and it planned further system changes to supplement time fields with the timezone and to display the revocation deadline. The bug was marked RESOLVED with resolution FIXED, and Mozilla indicated there were no further questions before closing.

1. 2020-05-12 A certificate problem report was delivered requesting revocation of certificates tied to a compromised private key SPKI.
2. 2020-05-13 GlobalSign effected revocation based on signed OCSP response timestamps for certificates using the specified SPKI.
3. 2020-06-08 GlobalSign adapted the case management system to display the revocation deadline; Mozilla asked whether the ticket could be closed.

1. 2020-05-21 Hezmatt representative — Reported that revocation occurred after the 24-hour expectation following a certificate problem report about a compromised private key SPKI.
2. 2020-05-21 GlobalSign nv-sa — Acknowledged the ticket and said GlobalSign started investigating.
3. 2020-05-21 GlobalSign nv-sa — Provided an incident timeline, explained the timezone confusion that set the internal revocation deadline too late, and described remediation steps including updating operator timezone settings and planned case management system changes.
4. 2020-05-22 Hezmatt representative — Asked why revocation deadlines were manually set instead of being automatically derived.
5. 2020-06-02 GlobalSign nv-sa — Said GlobalSign would further adapt the case management system to show the revocation deadline and noted completion of timezone supplementation on May 29, 2020.
6. 2020-06-08 GlobalSign nv-sa — Reported that on June 8, 2020 the case management system was adapted to display the revocation deadline and asked if more information was needed to close the ticket.
7. 2020-06-08 Mozilla representative — Stated there were no further questions and asked if anyone else had questions before closing.
8. 2020-06-09 GlobalSign nv-sa — Said GlobalSign audits certificate problem reports monthly and would have identified the >24 hour revocation during that audit.