QuoVadis revocation services validity exceeded CPS wording by one second

This case concerns QuoVadis revocation services whose configured validity periods were one second longer than the QuoVadis CPS described. DigiCert said GTS notified them that QuoVadis OCSP responses were 48 hours plus one second because the software treated the start time as inclusive, and the same issue affected CRL service timing. DigiCert updated the QuoVadis CPS to describe the revocation service timing accurately and said the revised CPS was approved and published on 2021-09-24. DigiCert also said it had stopped issuing CRL and OCSP responses outside the timeline specified in the QuoVadis CPS, and that a future EJBCA update was expected to correct the timing calculation. Mozilla indicated the matter could be closed, and the bug was resolved fixed.

1. 2021-09-23 QuoVadis OCSP and CRL validity periods were found to be one second longer than intended because of inclusive start-time handling.
2. 2021-09-24 The QuoVadis CPS was updated, approved, and published to describe revocation service timing accurately.
3. 2021-10-07 Mozilla said it planned to close the matter the following week.

1. 2021-09-28 DigiCert — DigiCert explained that GTS reported the one-second timing issue, described the CPS correction, and said CRL and OCSP issuance outside the CPS timeline had been stopped.
2. 2021-09-28 DigiCert — An attachment listing affected issuing CAs was added.
3. 2021-10-07 DigiCert — DigiCert said the issue was a CPS terminology correction and that the BR limits were still being met.
4. 2021-10-07 Mozilla representative — Mozilla said it would plan to close the matter on or about 2021-10-13.