← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1652604
Delayed Revocation
PKIoverheid: Failure to revoke within 7 days: OCSP EKU issue
RESOLVED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves PKIoverheid's failure to revoke certain certificates within the required timeframe of 7 days, as highlighted in Bug 1649964. The CA acknowledged the delay and indicated that a detailed incident report would be provided. Subsequent communications outlined a remediation plan, including the replacement of certificates under the 'Staat der Nederlanden Root CA - G3' with new certificates under the 'Staat der Nederlanden EV Root CA'. By early 2021, PKIoverheid reported that they had replaced up to 95% of the affected TLS certificates and were in the process of revoking the remaining certificates. The bug was resolved with a status of 'FIXED'.
Chronology
- Bug opened to track incident response regarding delayed revocation.
- PKIoverheid reported that 95% of TLS certificates had been replaced and planned revocation of remaining certificates.
- Bug closed after confirming resolution of the revocation issue.
Thread Activity
- Mozilla representative — Opening this bug to track incident response report on, and discussion regarding, CAs not yet revoked.
- Logius representative — Logius PKIoverheid requires more than 7 days to revoke the certificates affected by Bug 1649964.
- Logius representative — Up to 95% of the TLS-certificates have been replaced; remaining certificates will be revoked between January 11 and 22.
- Mozilla representative — I'll close this bug on or about next Wednesday, 31-March-2021.
Participants
Mozilla representative
Logius representative
Community commenter
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
PKIoverheid: Failure to revoke within 7 days: OCSP EKU issue
DigiCert: Failure to revoke within 7 days: OCSP EKU issue
Actalis: Failure to revoke within 7 days: OCSP EKU issue
Sectigo: Failure to revoke within 5 days
Sectigo: ZeroSSL: failure to revoke within 24 hours
Staat der Nederlandend / PKIoverheid: Non-BR-Compliant Certificate Issuance
Camerfirma: Failure to revoke within 7 days: OCSP EKU issue
Sectigo: Failure to revoke key-compromised certificates