DigiCert delayed revocation of key-compromised certificates after problem reports

This case concerns DigiCert’s failure to revoke certificates within 24 hours after receiving key-compromise problem reports. The bug was opened by a third party after three reports were sent to DigiCert’s revocation address between 2020-04-25 and 2020-05-02. The reporter stated that certificates for the affected SPKIs were revoked later than the required 24-hour window, and DigiCert acknowledged that it missed the deadlines. DigiCert explained that the delay was caused by a manual revocation process and said it needed to automate revocation to avoid similar misses. Over the following months, DigiCert described and then deployed a key-compromise portal and blacklist checker, and Mozilla indicated the bug could be closed once there were no further issues. The bug is resolved as FIXED.

1. 2020-04-25 DigiCert received a key-compromise report for one SPKI and revoked the affected certificates later than 24 hours after receipt.
2. 2020-05-02 DigiCert received two more key-compromise reports for separate SPKIs and revoked the affected certificates after the 24-hour deadline.
3. 2020-10-14 DigiCert said the key-compromise reporting portal was live and working.

1. 2020-05-21 Hezmatt representative — Opened the bug and reported three key-compromise problem reports that were not revoked within 24 hours.
2. 2020-05-21 DigiCert — Acknowledged that three certificate revocations missed the deadline and said the timer had not been set correctly.
3. 2020-06-02 DigiCert — Submitted an incident report describing the missed revocations, the manual process, and plans to automate revocation.
4. 2020-07-06 DigiCert — Said the key blacklist checker was live for DigiCert and asked whether the bug should remain open for S/MIME use.
5. 2020-07-07 Mozilla representative — Asked for short-term revocation automation plans and an example showing the blacklist checker working in practice.
6. 2020-08-13 DigiCert — Described the revised revocation system, said proof of key compromise would be accepted as actual private keys or CSRs plus a signed string, and said the project was expected to finish in early October.
7. 2020-10-06 DigiCert — Said the system was in testing, provided the problem-report URL, and stated the CPS would be updated effective 2020-10-15.
8. 2020-10-14 DigiCert — Said the system was now live and working.
9. 2020-11-10 DigiCert — Asked Mozilla to mark the bug resolved.