Apple CA: Test website certificates expired

On September 09, 2021, the Apple CA compliance team received notification from an internal security team that certificates for some of Apple CA’s test web pages (https://www.apple.com/certificateauthority/public/) had expired. Apple CA investigated and determined the issue did not affect business operations. The incident was traced to expiration notifications not being received because the operations team had been inadvertently removed from the email group used for expiration notifications; the group had been repurposed after the certificates were issued. Apple CA resumed investigation, notified the compliance team, and issued and deployed new certificates to the test web pages on September 09, 2021. Apple CA also added the test website endpoints to a monitoring application that proactively checks endpoints for certificate expiration. Apple CA stated there were no outstanding tasks and asked to close the incident report; Mozilla indicated it would close the bug unless there were objections. The bug is resolved as FIXED.

1. 2020-04-03 Certificates for Apple CA’s test web pages were deployed.
2. 2021-01-21 The operations team was inadvertently removed from the email group used for expiration notifications.
3. 2021-09-08 The operations team was notified that some Apple CA test web page certificates had expired and began investigating.
4. 2021-09-09 New certificates were issued and deployed to Apple CA’s test web pages.
5. 2021-09-14 Test website endpoints were added to a monitoring application for proactive certificate-expiration checks.

1. 2021-09-11 Apple representative — Apple CA reported that it received notification on September 09, 2021 that certificates for its test web pages had expired, and said the issue was resolved with a full report to follow by September 17, 2021.
2. 2021-09-17 Apple representative — Apple CA submitted an incident report describing how the operations team was removed from the expiration-notification email group, the timeline of investigation and remediation, and that no problematic certificates remained.
3. 2021-09-17 Thisisntrocket representative — A participant asked whether Apple CA’s monitoring notifies in advance or only after certificates expire.
4. 2021-09-21 Apple representative — Apple CA replied that monitoring checks endpoints daily and starts alerting 30 days before a certificate expires.
5. 2021-09-27 Apple representative — Apple CA stated there were no outstanding tasks and asked whether the incident report could be closed.
6. 2021-09-28 Mozilla representative — Mozilla said it would close the bug the next day unless there were objections.