Telekom Security: Delayed Revocations of Sub-CA certificates

This case involves Deutsche Telekom Security GmbH's delayed revocation of several Sub-CA certificates due to the significant impact on over 230,000 users. The CA disclosed that it required more than seven days to revoke the affected certificates, citing the need for a careful migration process. Throughout the thread, the CA provided updates on the migration progress and the revocation of specific certificates. By November 2020, all affected certificates had been revoked, and key material was destroyed in the presence of an external auditor. The case has been resolved with all actions completed.

1. 2020-07-08 CA disclosed delayed revocation of certificates affecting over 230,000 users.
2. 2020-11-10 All remaining affected certificates were revoked.
3. 2020-11-12 Key material for revoked certificates was destroyed.

1. 2020-07-08 Telekom representative — Telekom Security requires more than seven days to revoke the certificates affected by a previous bug.
2. 2020-07-17 Telekom representative — Updates will be provided on behalf of Arnold Essing during his absence.
3. 2020-07-24 Telekom representative — Migration for affected CAs has started as planned.
4. 2020-08-27 Telekom representative — Revocation of all EE certificates from "TeleSec PKS CA 8" was completed.
5. 2020-11-13 Telekom representative — All EE certificates from the remaining affected CAs were revoked.
6. 2020-12-03 Mozilla representative — Intended to close the matter unless additional issues arise.