Camerfirma: Delayed revocations related to Invalid authorityKeyIdentifier (recurrent incident)
This case is an incident report for Camerfirma covering delayed revocation of certificates associated with problems tracked in Bug 1623384. The bug was opened because Camerfirma experienced delays in revoking the affected certificates, with some certificates revoked up to 7 days after Mozilla policy deadlines. Camerfirma stated that it first became aware of certificate problems, investigated to identify affected certificates, and contacted clients to begin revocation and substitution. Camerfirma reported that it substituted and revoked most problematic certificates, but some clients requested a grace period due to COVID-19, and some revocations were completed after the deadline. The thread includes specific examples of certificates with delays (e.g., 1-day, 4-day, and 7-day delays) and Camerfirma’s explanation that exceptional circumstances (including COVID-19-related quarantine and subscriber requests for critical services) contributed to the delay. Camerfirma also stated it implemented a new massive revocation and substitution process to perform tasks more easily and quickly. The bug is marked RESOLVED with resolution FIXED.
- Mozilla opened an incident report bug for Camerfirma due to delayed revocation tied to problems in Bug 1623384.
- Camerfirma provided details on the revocation delays, affected certificates, and its remediation steps.
- Camerfirma further explained the exceptional circumstances for specific delayed certificates.
- Mozilla indicated the issue could be closed.
- Mozilla representative — Opened the CA incident report as required due to delayed revocation noted in Bug 1623384.
- AC Camerfirma, S.A. — Provided a timeline and explanation for the revocation delays, listed certificates with 1–7 day delays, and described a new massive revocation and substitution process.
- AC Camerfirma, S.A. — Attached a file listing fingerprints of affected certificates.
- Community commenter — Noted that the described grace-period rationale did not meet Mozilla’s incident response expectations and pointed to the CA responding to an incident guidance.
- AC Camerfirma, S.A. — Explained the exceptional reasons for specific delayed certificates, including COVID-19 quarantine and subscriber requests related to critical communication services.
- Mozilla representative — Stated an intention to close the issue on or about 19-October-2020 unless other issues were raised.