Camerfirma: Failure to revoke within 7 days: OCSP EKU issue

Camerfirma faced issues with the timely revocation of a non-compliant intermediate CA, which raised concerns about the potential for misissuance and the adequacy of their controls. The situation was exacerbated by a proposed six-month delay in replacing the non-compliant CA. Throughout the discussions, Camerfirma acknowledged the risks and outlined a comprehensive plan to transition to a compliant CA, which included revocation and destruction of the non-compliant CA's private key. The case was resolved with the successful revocation and destruction of the key, although concerns about the lack of external auditor verification were noted.

1. 2020-07-13 Bug opened to track incident response for delayed revocation.
2. 2020-10-02 Revocation of the non-compliant intermediate CA and destruction of its private key completed.