Camerfirma delayed revocation of certificates issued by old CAs with 2047-bit RSA moduli

AC Camerfirma opened this bug to report delayed revocation of a large set of certificates issued by old CAs with RSA moduli of 2047 bits. Camerfirma said it learned of the issue after notification and was already working on a substitution process to replace affected certificates, while also prioritizing revocation of the impacted certificates. The company initially planned to revoke certificates in batches, but later said the first revocation strategy caused significant customer support impact and it changed to a more gradual, client-coordinated approach. Over the course of the thread, Camerfirma repeatedly reported revocation progress and the remaining pending certificates, including a final batch of 671 doctor certificates in Galicia. On 2022-01-18, Camerfirma stated that all 28,465 certificates in scope had been revoked. Mozilla later asked whether the issue could be considered closed, and the bug was subsequently resolved.

1. 2021-02-12 Camerfirma reported delayed revocation of affected certificates and began a substitution process.
2. 2021-03-23 The first batch of affected certificates was revoked.
3. 2021-08-06 Camerfirma reported 671 certificates still pending revocation, all belonging to doctors from Servicio Gallego de Salud.
4. 2022-01-18 Camerfirma stated that all 28,465 certificates in scope had been revoked.

1. 2021-02-12 AC Camerfirma, S.A. — Camerfirma said it had been notified of the problem, was already in a substitution process, and was managing revocations in prioritized batches.
2. 2021-02-26 AC Camerfirma, S.A. — Camerfirma said it had divided the certificates into batches, notified the first batch, and planned to revoke the first 13,877 certificates on 2021-03-23.
3. 2021-03-29 AC Camerfirma, S.A. — Camerfirma said the initial revocation strategy caused customer support problems and that it had stopped the planned revocations until a new strategy was defined.
4. 2021-04-09 AC Camerfirma, S.A. — Camerfirma reported 40,510 affected certificates, 4,703 revoked, and 35,807 still alive, and said it would continue the process.
5. 2021-08-06 AC Camerfirma, S.A. — Camerfirma reported 27,794 revoked, 671 pending revocation, and said those remaining certificates belonged to doctors in Galicia.
6. 2022-01-18 AC Camerfirma, S.A. — Camerfirma said the last 30 certificates in the final batch had been revoked and that all 28,465 certificates were revoked.
7. 2022-02-11 Mozilla representative — Mozilla asked whether the issue could be considered closed and said it would schedule closure for 2022-02-18.
8. 2022-02-16 Mozilla representative — An auto-nag noted that the assignee had not logged in for seven months and asked for review.