GlobalSign: Failure to revoke noncompliant certificates within 5 days
This case concerns GlobalSign’s failure to revoke noncompliant certificates within the 5-day timeframe required by Mozilla’s SSL Baseline Requirements section 4.9.1.1. GlobalSign said it became aware of the compliance issue while handling Bug 1654544, but the last affected certificates were revoked 19 days after GlobalSign became aware. GlobalSign provided a timeline describing identification of the underlying issue (CloudSSL 1.0 random values not being reset as expected), investigation, remediation, and revocation. It stated that domains validated with expired random values were reset to expired and that certificates issued relying on a random value > 30 days were revoked. Mozilla asked for more concrete details early in the thread, and GlobalSign later stated that all actions described in its report were completed mid-August. The bug was then marked as closed by Mozilla, with the resolution shown as FIXED.
- GlobalSign identified that CloudSSL 1.0 random values were not reset as expected due to a script failure.
- GlobalSign revoked certificates issued relying on a random value > 30 days.
- GlobalSign reported completion of actions described in its compliance incident report (completed mid-August).
- GlobalSign nv-sa — Opened the bug to capture GlobalSign’s failure to revoke certificates affected by Bug 1654544 within 5 days, stating an incident report would follow.
- Community commenter — Asked Arvid to provide something more concrete than “later.”
- GlobalSign nv-sa — Explained how GlobalSign became aware, cited the 5-day requirement, and provided a detailed timeline including revocation actions; included links to certificate lists.
- Community commenter — Thanked for the update and discussed concerns about late reporting and triage/oversight expectations.
- GlobalSign nv-sa — Described plans to expand the compliance incident team via training and stated oversight and authority for senior management to act on deadlines.
- GlobalSign nv-sa — Asked whether more information was required or if the bug could be closed, stating actions were completed mid-August.
- Mozilla representative — Agreed the bug could be closed and scheduled it for on or about 18-Sept-2020.