← DigiCert cases
Bugzilla #1651553
Delayed Revocation
QuoVadis: Failure to revoke within 7 days: OCSP EKU issue
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns QuoVadis's failure to revoke certain certificates within the required 7-day timeframe due to an issue related to the OCSP EKU. The CA acknowledged that it could not revoke all impacted CAs in the mandated period and provided updates on the complexity of the situation, which involved approximately 1.3 million end entity certificates across 30 issuing CAs. QuoVadis has since ceased using the id-kp-OCSPSigning EKU in new issuing CAs and is reviewing its practices to ensure compliance with the Baseline Requirements. The issue has been resolved with all affected certificates revoked and key destruction completed.
Chronology
- The remaining Siemens operated subCAs affected by this bug have been revoked.
Thread Activity
- DigiCert — QuoVadis acknowledges it will not be able to revoke all impacted CAs in the mandated period.
- DigiCert — QuoVadis explains the complexity of the bug and outlines steps taken to address the issue.
- DigiCert — Final QuoVadis operated CAs have been revoked with key destruction.
- Mozilla representative — The bug is suggested for closure as all necessary actions have been completed.
Participants
DigiCert
Mozilla representative
Community commenter
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
QuoVadis: Failure to provide a preliminary report within 24 hours.
QuoVadis: use of Organisationidentifier field in EV (Pre CABF Ballot SC17)
QuoVadis: Unconstrained CAs revocation
DigiCert: Failure to revoke within 7 days: OCSP EKU issue
QuoVadis: Failure to provide a preliminary report within 24 hours
DigiCert: Failure to revoke key-compromised certificates within 24 hours
DigiCert: Delay of revocation for EV audit inconsistency incident
Disig: Failure to provide a preliminary report within 24 hours.