Camerfirma: Old CAs with an RSA modulus size of 2047 bits

This case concerns Camerfirma’s CA certificates that were identified as problematic because they involved an RSA modulus size of 2047 bits. Camerfirma said it became aware of the situation after receiving an email from Michael Lettona on February 5, and it studied the affected certificates. Camerfirma reported that it detected 40,510 problematic certificates, with the first issued on 2014-01-02 and the last issued on 2021-02-12 due to a client using an old issuance link by mistake. Camerfirma stated that it stopped issuing certificates with the problem, deactivated the affected profiles to prevent future errors, and provided clients with a link to issue new certificates using a not affected CA. Camerfirma also described a substitution and revocation approach, including batching revocations and notifying customers, with the first batch revocation planned for March 23 and the last batch by September 15 at latest. The bug thread indicates the revocation process updates were moved to another Bugzilla bug (1692535), and Camerfirma later stated there were no more updates for this bug. The bug is resolved as FIXED.

1. 2021-02-05 Camerfirma received an email alerting it to the problematic CA situation involving 2047-bit RSA modulus certificates.
2. 2021-02-12 Camerfirma reported that the last problematic certificate was issued due to a client using an old issuance link by mistake.
3. 2021-02-23 Camerfirma began the substitution and revocation process by notifying the first batch of customers.
4. 2021-03-23 Camerfirma planned to revoke the first batch of problematic certificates.
5. 2021-09-15 Camerfirma planned to revoke the last batch of problematic certificates by this date at latest.

1. 2021-02-12 AC Camerfirma, S.A. — Created the case describing the 2047-bit RSA modulus issue, stating Camerfirma stopped issuing the affected certificates, deactivated affected profiles, and provided clients with a new issuance link; it also reported 40,510 problematic certificates and outlined a substitution/revocation plan.
2. 2021-02-26 AC Camerfirma, S.A. — Explained that revocations would be performed in batches, starting February 23 with the first 13,877 certificates planned for revocation on March 23, and that updates would be posted as batches are revoked.
3. 2021-02-26 AC Camerfirma, S.A. — Noted that revocation process updates were moved to Bugzilla bug 1692535 and provided the link.
4. 2021-03-12 AC Camerfirma, S.A. — Stated there were no more updates for this bug and that the revocation process was available at bug 1692535.
5. 2021-03-19 AC Camerfirma, S.A. — Stated there were no more updates for this bug.