Disig: Failure to provide a preliminary report within 24 hours after a certificate problem report

This case began when an external reporter told Disig that some of its TLS/SSL certificates contained an invalid stateOrProvinceName value of "Slovakia". The initial complaint was that Disig did not provide a preliminary report within 24 hours after receiving the report on its t**********y@disig.sk address. Disig said it first saw the message on 2020-10-10, chose to wait until Monday to respond, and later acknowledged that it did not realize a preliminary report was required within 24 hours. The thread also covered the underlying certificate issue: Disig stopped issuing affected certificates, changed its TLS/SSL profiles so they would no longer contain stateOrProvinceName, reissued many affected certificates, and revoked the remaining misissued certificates. Mozilla participants asked for clarification on the delay and on Disig’s handling process, and later indicated the matter had been adequately discussed. The bug was resolved FIXED.

1. 2020-10-10 Disig received a report about TLS/SSL certificates containing stateOrProvinceName = Slovakia.
2. 2020-10-12 Disig stopped issuing affected certificates and began responding to the report.
3. 2020-10-13 Disig changed its TLS/SSL profiles so they would no longer contain subject:stateOrProvinceName.
4. 2020-10-14 Disig revoked 77 certificates on the misissued.com batch list.
5. 2020-10-21 Disig revoked 17 additional certificates from the affected set; one had expired.

1. 2020-10-11 Fozzie representative — Reported that a problem report had been sent to Disig and no preliminary report had been received within 24 hours.
2. 2020-10-12 Disig, a.s. — Said Disig received the message, did not respond immediately over the weekend, and believed there was no Baseline Requirements violation.
3. 2020-10-12 Fozzie representative — Explained that the certificates were misissued because the stateOrProvinceName value was not valid.
4. 2020-10-12 Community commenter — Asked Disig to explain its interpretation of the Baseline Requirements and its triage process.
5. 2020-10-12 Disig, a.s. — Described the affected certificates, said issuance had stopped, and said 81 certificates were involved.
6. 2020-10-13 Disig, a.s. — Updated the timeline to say Disig would contact customers, revoke the misissued certificates, and reissue new ones without stateOrProvinceName.
7. 2020-10-25 Mozilla representative — Commented that the subdivision names appeared to fit the definition of state or province and would not need revocation.
8. 2020-11-19 Disig, a.s. — Said the delay was his fault, that the address is monitored by four people, and that Disig would now be prepared to provide a preliminary report within 24 hours.
9. 2021-01-17 Mozilla representative — Stated the matter had been adequately discussed and addressed and intended to close it.