Actalis: delayed revocation related to inaccurate value in stateOrProvinceName

This case concerns Actalis revoking one certificate later than the Baseline Requirements allowed. Actalis stated that it had to grant its customer a delay of a few days in revoking one particular certificate (out of 20) rather than revoking within 5 days. Actalis attributed the delay to the practical difficulty for the customer to replace that single certificate within the 5-day window, and said it found no meaningful security risks associated with the inaccurate (but not misleading) value of stateOrProvinceName. Actalis said it was implementing measures to reduce the likelihood and extent of future revocation delays, including promoting automation of certificate enrollment and adoption of ACME, and adding CPS warnings and clarifications discouraging invalid reasons to delay revocation. In follow-up, Mozilla asked for an update on CPS currency and Actalis confirmed the most recent CPS version and that clarifications/warnings were inserted. Actalis later reported progress toward ACME adoption, including major customers using ACME, positive feedback from other customers, and a testing phase. The bug is marked RESOLVED with resolution FIXED.

1. 2020-10-13 Actalis disclosed a delayed revocation incident involving one certificate that was revoked a few days later than allowed.
2. 2020-12-04 Actalis confirmed its CPS version and that clarifications/warnings were added.
3. 2021-01-15 Actalis provided an update on ACME automation progress and planned measures to support adoption.
4. 2021-01-22 Mozilla indicated intent to close the bug around 27-Jan-2021 unless issues remained.

1. 2020-10-13 Staff representative — Actalis reported that it delayed revocation by a few days for one certificate (out of 20) due to customer replacement difficulty and the lack of meaningful security risk from an inaccurate stateOrProvinceName value, and described remediation steps including ACME promotion and CPS clarifications.
2. 2020-12-03 Mozilla representative — Mozilla asked whether Actalis had a more current CPS than Version 5.8 dated Oct 05, 2020.
3. 2020-12-04 Staff representative — Actalis replied that Version 5.8 was the most recent and that clarifications and warnings were inserted in section 1.4.2.
4. 2021-01-05 Community commenter — Mozilla requested an update on automation and asked for concrete steps to ensure automation adoption prevents future delays.
5. 2021-01-15 Staff representative — Actalis provided an update that some major customers already obtain certificates via ACME, that other customers gave positive feedback, and that testing with some customers was planned.
6. 2021-01-15 Community commenter — Mozilla acknowledged progress and suggested additional concrete actions such as monitoring the percentage of automated issuance and assessing customer-level adoption.
7. 2021-01-22 Mozilla representative — Mozilla stated it would close the bug on or about 27-Jan-2021 unless issues still needed addressing.