KIR S.A.: Delayed revocations of certificates

Krajowa Izba Rozliczeniowa S.A. (KIR) reported a delayed revocation issue involving 225 certificates that were issued with a validity period exceeding the allowed limit. The CA became aware of the problem through a third-party report and acknowledged the failure to revoke the certificates within the required timeframe. KIR implemented a replacement plan and communicated with affected clients to ensure timely certificate replacement. By June 2021, KIR had revoked all but one of the affected certificates, with the final revocation completed shortly thereafter. The CA has committed to improving its processes to prevent future delays, including the development of an ACME server to facilitate quicker certificate issuance and management.

1. 2021-05-06 KIR S.A. reported delayed revocations of certificates.
2. 2021-06-16 All affected certificates were revoked except one.
3. 2021-06-17 Final affected certificate was revoked.
4. 2022-01-21 Changes to improve revocation processes were successfully deployed.

1. 2021-05-06 Kir representative — KIR reported the delayed revocation of certificates and outlined the timeline of actions taken.
2. 2021-05-06 Community commenter — Requested KIR to redo the report to meet Mozilla's expectations for incident reporting.
3. 2021-05-12 Kir representative — KIR provided an update on the ongoing replacement process.
4. 2021-06-05 Kir representative — Reported that 82% of affected certificates were revoked.
5. 2022-01-21 Kir representative — Announced successful deployment of changes to improve revocation processes.