E-Tugra: Delayed response to a third-party certificate revocation request

This case concerns E-Tugra’s delayed response to a certificate revocation request submitted by a third party. E-Tugra reported that it received an email on 15 Jan 2021 15:04 (UTC) from George (g**********e@fozzie.dev) about revocation of a certificate for “cebimde.com.tr” and that the revocation was completed on 18 Jan 2021, but the response to the reporter was not completed within 24 hours. E-Tugra stated that technical staff queried its systems on 16 Jan and sent the issue to the Security Group for investigation, and that the Security Group investigated and revoked on 18 Jan and sent an information email to the reporter. E-Tugra attributed the delay to factors including certificate history/queued deletion preventing creation of a new revocation request, and that email-based third-party revocation requests were handled manually and not marked as revocation requests in the ticketing system. As remediation, E-Tugra created a new email address and contact information for third-party revocation requests so emails are directed to the ticketing system as revocation requests, updated its CPS and internal revocation process documents to clarify revocation channels and request methods, and added a procedure requiring a response within 24 hours even if action cannot be taken. The bug was resolved as FIXED, and Mozilla indicated it would be scheduled for closure on or about 7-April-2021.

1. 2021-01-15 E-Tugra received a third-party email requesting revocation for a certificate covering cebimde.com.tr.
2. 2021-01-18 The certificate revocation was completed by E-Tugra.
3. 2021-01-19 E-Tugra created the Bugzilla case after deciding to file a bug related to the delayed response.
4. 2021-01-29 E-Tugra provided an incident timeline and described root causes and planned procedural/system changes.
5. 2021-03-31 E-Tugra reported implementation of a dedicated third-party revocation contact, CPS/process updates, and a 24-hour response procedure.
6. 2021-04-02 Mozilla scheduled the bug for closure on or about 7-April-2021.

1. 2021-01-19 E-Tugra — Filed a preliminary report describing receipt of the revocation email on 15 Jan 2021, completion of revocation on 18 Jan 2021, and a delayed response beyond 24 hours, along with an initial investigation and planned procedure enhancements.
2. 2021-01-19 Fozzie representative — Commented that the CPS language appears ambiguous about revocation request procedures for third parties and suggested clarifying accepted third-party submission methods, citing CPS sections and URLs.
3. 2021-01-29 E-Tugra — Provided a more detailed timeline and described root causes, including manual handling of email-based third-party revocation requests not being marked as revocation requests in the ticketing system.
4. 2021-03-31 E-Tugra — Reported an update and closure request, stating that a dedicated third-party revocation email/contact was created, CPS and internal documents were updated, and a mandatory 24-hour response procedure and staff training updates were completed.
5. 2021-04-02 Mozilla representative — Stated that the bug would be scheduled to be closed on or about Wed. 7-April-2021.