Buypass: PSD2 QWAC with RSA modulus not divisible by 8

This case reports an incident involving a single PSD2 QWAC certificate issued by Buypass with an RSA key modulus not divisible by 8. Buypass said it became aware of the problem on July 17, 2020 after Digicert notified it. In response, Buypass temporarily stopped issuance of all manually issued certificates, analyzed active certificates, and found no other affected certificates. Buypass then restarted issuance of manually issued certificates with an added manual control to check the key size before issuance, and it notified the customer that the affected certificate needed to be revoked within five days. Buypass later revoked the affected certificate and stated that no more certificates were issued with this problem. The bug was resolved as FIXED, and Mozilla indicated it would be closed unless there were further issues or questions, referencing Bug 1632632 for related control improvements.

1. 2020-07-17 Buypass stopped manually issued certificate issuance after being notified of a PSD2 QWAC RSA modulus compliance issue.
2. 2020-07-17 Buypass restarted manually issued certificate issuance with an added pre-issuance manual key-size control.
3. 2020-07-21 Buypass revoked the affected certificate within the stated five-day window.
4. 2020-09-21 Mozilla indicated it would close the bug unless further issues or questions were raised.

1. 2020-07-21 Buypass — Opened the incident report describing the affected PSD2 QWAC, how Buypass became aware (Digicert notification), and the response steps including stopping issuance, adding controls, and revoking the certificate.
2. 2020-08-06 Mozilla representative — Requested an update around 25-Aug-2020 regarding the other referenced bug.
3. 2020-08-25 Buypass — Reported that CSR public key analysis is part of the controls described in the latest update for Bug 1632632 and that responsibility would be assigned to that control.
4. 2020-09-04 Buypass — Stated there was no new information to this bug.
5. 2020-09-20 Community commenter — Expressed support for closing, noting Bug 1632632 shows Buypass engaging in holistic review and referenced a comment thread for context.
6. 2020-09-21 Mozilla representative — Indicated the bug would be closed on or about 25-Sept-2020 unless there were other issues or questions.