Izenpe: Failure to revoke within 5 days
This case concerns Izenpe’s delayed revocation of subscriber certificates after a misissuance event. Izenpe stated that the incidence was reported on 16 July 2020 at 15:18 UTC, when the 5-day Baseline Requirements revocation deadline ended on 21 July 2020 at 15:18 UTC. Izenpe reported that the affected certificates were revoked on 22 July 2020 at 07:23 UTC, which it characterized as 16 hours and 5 minutes later than the deadline. Izenpe said the issue was not with issuance, but with revocation, and that 12 certificates were involved, providing CT log links for the certificates. In response, Izenpe described remediation focused on improving communication to the revocation team: it added a new internal event type (“Certificate misissuance”) so the automated email to the revocation team includes the deadline to revoke affected certificates. Mozilla staff indicated the issue could be closed, stating they would close it on or about 6 November 2020 unless further discussion was needed. The bug is marked RESOLVED with resolution FIXED.
- Izenpe reported an incidence related to misissuance, starting the 5-day revocation deadline under Baseline Requirements.
- Izenpe revoked the affected certificates after the 5-day deadline had passed.
- Izenpe planned an improvement to classify a new type (“SSL certificate misissuance”) in its internal database.
- Izenpe S.A. — Oscar Garcia explained that revocation occurred 16 hours and 5 minutes after the 5-day deadline, provided a timeline, and listed 12 affected certificates via crt.sh links.
- Community commenter — Ryan Sleevi requested more detail on remediation and how it would prevent recurrence, including whether controls were technical or manual.
- Izenpe S.A. — Oscar Garcia said the revocation team did not receive information correctly and described adding an internal event type so automated emails include the revocation deadline.
- Community commenter — Ryan Sleevi expressed concern that it took nearly a month to update and asked about ensuring timely communications.
- Izenpe S.A. — Oscar Garcia said there was no written procedure specifying response time to Bugzilla requirements, noted they should meet Mozilla requirements and update at least weekly, and attributed the delayed bug update to summer holidays and COVID.
- Mozilla representative — Mozilla staff stated the issue could be closed and would close it on or about 6 November 2020 unless further discussion was needed.