Apple: EV Certificate Approver Authorization
Apple reported an incident discovered during an internal self-audit for EV certificate requests. Apple identified that a recently issued EV certificate had been approved by a Certificate Approver who was not properly authorized for EV Authority, and additional investigation found five more internal EV certificates with the same pattern. Apple blocked pending EV certificate requests from issuance starting 2020-08-13 09:22 PT, then sent requests to a Contract Signer to authorize the affected Certificate Approvers for EV Authority. After EV Authority was authorized, Apple unblocked issuance, and Apple later reported that all impacted certificates had been revoked as of 2020-08-17 08:49:25 PT. Apple also stated it implemented a solution to systematically enforce Contract Signer approval before a Certificate Approver is configured for EV Authority, and strengthened related manual processes using features of its in-house ticketing system. Mozilla indicated the bug could be closed unless further questions remained, with closure scheduled on or about 2-Oct-2020. The bug is marked RESOLVED with resolution FIXED.
- Apple identified during an internal EV certificate self-audit that multiple EV certificates had been approved by Certificate Approvers not properly authorized for EV Authority.
- Apple blocked pending EV certificate issuance, obtained Contract Signer authorization for the affected approvers, and then unblocked issuance.
- Apple reported that all impacted EV certificates had been revoked.
- Apple implemented a systematic enforcement solution for Contract Signer approval before EV Authority configuration and strengthened manual processes via ticketing workflow controls.
- Apple representative — Apple submitted an incident report describing how it discovered the issue in a self-audit, the affected EV certificates, issuance blocking/unblocking steps, revocation expectations, and remediation actions.
- Apple representative — Apple stated that as of 2020-08-17 08:49:25 PT all impacted certificates had been revoked.
- Apple representative — Apple reported it had identified a solution to enforce Contract Signer approval before EV Authority configuration and expected production implementation the next week.
- Apple representative — Apple stated it implemented the enforcement solution and strengthened manual processes using additional ticketing system workflow features requiring two-person confirmation.
- Community commenter — Mozilla community member asked for more detail about what Apple meant by leveraging additional ticketing system features.
- Apple representative — Apple described ticketing system features (workflow states, ownership of states, automated transition) and how manual processes were mapped into the workflow with two-person confirmation.
- Community commenter — The community member asked how the workflow handles situations like an owner being unavailable and time-sensitive escalations.
- Apple representative — Apple explained that multiple qualified people can perform steps, the ticketing workflow supports proxy approver designation, and it described how time-sensitive issuance correlation/approval is handled by a redundant team.
- Mozilla representative — Mozilla stated the bug could be closed unless additional questions or concerns remained and scheduled closure on or about 2-Oct-2020.