Google Trust Services: Failure to revoke subscriber certificates within BR timeframe

This case involves Google Trust Services (GTS) failing to revoke subscriber certificates within the required timeframe as mandated by the Baseline Requirements (BR). The issue was triggered when GTS was informed of a compliance failure regarding their domain control validation method on April 22, 2021, but did not complete the revocation until May 1, 2021, exceeding the 24-hour and 5-day requirements. GTS acknowledged the delay and provided a timeline of actions taken in response, including updates to their Certificate Policy and the initiation of mass reissuance of certificates. The case has been resolved with GTS implementing changes to their processes to prevent future delays.

1. 2021-04-22 GTS informed of unauthorized domain control validation method.
2. 2021-05-01 GTS completed revocation of affected certificates.

1. 2021-06-09 Community commenter — Detailed the timeline and compliance failures regarding certificate revocation.
2. 2021-06-09 Google representative — GTS acknowledged the bug and promised a response.
3. 2021-06-14 Google representative — GTS provided a detailed incident report and timeline of actions taken.
4. 2021-06-15 Community commenter — Requested further clarification on GTS's root cause analysis.
5. 2021-08-20 Mozilla representative — Proposed to close the bug as the issues have been addressed.