GlobalSign: Failure to provide a preliminary report within 24 hours
GlobalSign reported that it exceeded the Baseline Requirements #4.9.5 timeline for acknowledging a certificate problem report. The CA stated that it received two misissuance-related cases via its report-abuse email address on 25/09/2020 at 20:55 BST and 21:37 BST, but acknowledged them only on 27/09/2020 at 20:54 BST, which exceeded the required 24 hours. GlobalSign said it would provide a full incident report by Friday October 2. In the thread, GlobalSign described a timeline in which Compliance began investigation on 27/09/2020 and, together with Security and Support, concluded that the Support process for misissuance cases lacked critical steps (including immediate escalation to Compliance) and that the SOC process lacked evidence requirements for the response sent to the reporter. GlobalSign stated that it updated Support, SOC, and Compliance processes, including escalating misissuance cases to Compliance immediately and requesting evidence of the (preliminary) report every 4 hours until provided. The bug was later marked RESOLVED with resolution FIXED, and Mozilla indicated it could be closed after 20-November-2020.
- GlobalSign received two misissuance-related cases via its report-abuse email address.
- GlobalSign acknowledged the received cases after the required 24-hour window.
- GlobalSign provided the requested incident-response timeline and process updates.
- GlobalSign nv-sa — GlobalSign stated it acknowledged two certificate problem reports after the 24-hour requirement and said it would provide a full incident report by Oct 2.
- GlobalSign nv-sa — GlobalSign provided details on when it became aware of the problem, the timeline of actions, and process updates to address the delayed preliminary reporting.
- GlobalSign nv-sa — GlobalSign asked whether more information was required or the ticket could be closed.
- Mozilla representative — Mozilla said the issue could be closed and scheduled closure for 20-November-2020.