Certainly: Root CRL validity period exceeds maximum by one second

This case concerns Certainly’s root CRLs having a validity period that exceeded the maximum allowed by one second. Certainly identified the issue during a routine weekly compliance meeting on 22-Sep-2021 while reviewing bug 1731164, and determined that its two current root CRLs (valid 1-April 2021 00:00:00 UTC to 1-April 2022 00:00:00 UTC) may not comply with BR section 4.9.7 regarding the nextUpdate field being no more than twelve months beyond thisUpdate. Certainly stated that certificate issuance was not stopped because the issue did not result in misissuance of any certificates, and that two CRLs were impacted. Certainly initiated an incident management process, informed its Policy Management Authority and auditors, posted a preliminary incident report, and later posted a full incident report. Remediation steps included publishing new fully compliant root CRLs by 1-November-2021 and reducing OCSP nextUpdate interval by one second; Certainly reported that updated CRLs with a validity interval of 364 days were signed on 28-Oct and published on 29-Oct, and that all remediation steps were completed. Mozilla indicated it would close the bug on or about 4-Nov-2021 unless there were questions or concerns, and the bug is marked RESOLVED with resolution FIXED.

1. 2021-09-22 Certainly reviewed a related compliance bug and identified that its current root CRLs may not meet BR section 4.9.7 due to a one-second excess in the validity interval.
2. 2021-10-29 Updated root CRLs with a 364-day validity interval were published after remediation.

1. 2021-09-27 Fastly representative — Wayne Thayer reported that Certainly’s two current root CRLs were valid from 1-April 2021 to 1-April 2022 and may violate BR 4.9.7, and said a full incident report was being prepared.
2. 2021-10-04 Fastly representative — Wayne Thayer posted a detailed incident report including the timeline, stating no certificate misissuance occurred and describing remediation plans (new root CRLs by 1-November 2021 and OCSP nextUpdate interval reduction).
3. 2021-10-11 Fastly representative — Wayne Thayer updated that Certainly was on track to publish new root CRLs by 1-November, discussed the issue with the CAB Forum Validation subcommittee, and expected to reduce OCSP nextUpdate interval in the next week.
4. 2021-10-18 Fastly representative — Wayne Thayer reported continued progress: on track for 1-November root CRLs, feedback addressed on ballot SC52, and that the OCSP validity interval reduction by one second had been deployed and verified.
5. 2021-10-25 Fastly representative — Wayne Thayer reported that feedback on ballot SC52 was addressed and that the proposer discussion period was expected to start soon.
6. 2021-11-01 Fastly representative — Wayne Thayer stated that updated CRLs with a 364-day validity interval were signed on 28-Oct and published on 29-Oct, and that all remediation steps were completed.
7. 2021-11-02 Mozilla representative — Ben Wilson said Mozilla would close the bug on or about Thursday, 4-Nov-2021 unless there were questions or concerns.