Google Trust Services: CRL validity period set to expected value plus one second

Google Trust Services reported a preliminary incident involving the validity period of CRLs used by its secondary CA system running EJBCA. The issue was identified on 2021-09-10 16:04 UTC during a periodic review by a Compliance Engineer, who found the CRL validity period configured as 10 days but potentially resulting in an actual validity period of 10 days plus one second due to EJBCA configuration. The CA stated that RFC 5280 makes the CRL next update field inclusive of the final second, and that while the Baseline Requirements do not explicitly state CRL validity duration in the same inclusive way, Google believed the behavior was against the spirit of the BRs. Google deployed a fix on 2021-09-10 21:53 UTC and deployed it to all systems by 2021-09-16 18:32 UTC, publishing new CRLs on 2021-09-10 20:45 UTC. The CA stated the issue did not result in misissuance of certificates and that certificate issuance was not stopped. Google later reported that remediation steps were completed and requested the bug be marked Fixed; Mozilla indicated it would schedule closure, and the bug is resolved as FIXED.

1. 2021-09-10 Google Trust Services identified that CRL validity periods on its secondary EJBCA system could be 10 days plus one second and initiated remediation.
2. 2021-09-10 Google Trust Services published new CRLs after deploying a fix to correct the CRL validity period.
3. 2021-09-16 Google Trust Services completed deployment of the CRL validity period fix across all systems.
4. 2021-10-14 Google Trust Services reported remediation completion and requested the bug be marked Fixed.
5. 2021-10-20 Mozilla scheduled closure of the bug (per comment indicating closure next Wed).

1. 2021-09-16 Google representative — Opened a preliminary incident report describing discovery of CRL validity period being 10 days plus one second, the rationale, and that a fix was deployed and new CRLs were published.
2. 2021-09-23 Google representative — Provided a detailed incident timeline and explanation, including that the issue did not result in misissuance and that remediation was underway/completed as of the patch deployment.
3. 2021-09-29 Google representative — Stated Google Trust Services was monitoring the bug for additional updates or questions.
4. 2021-10-05 Google representative — Stated Google Trust Services was monitoring the bug for additional updates or questions.
5. 2021-10-11 Google representative — Stated Google Trust Services was monitoring the bug for additional updates or questions.
6. 2021-10-14 Google representative — Reported completion of remediation steps, said no community concerns were raised, and asked Mozilla to advise on marking the bug as Fixed, referencing guidance and a CABF draft ballot.
7. 2021-10-14 Mozilla representative — Responded that Mozilla would schedule closure next Wednesday (20-Oct-2021).