SECOM: Root CRLs exceed maximum validity period by 1 second

SECOM reported an incident involving its Root CRLs for SECOM, where the CRL validity period was issued as 365 days and 1 second. SECOM stated that on September 28, 2021, four Root CRLs were generated with a nextUpdate value 1 second beyond the maximum allowed twelve-month window. SECOM’s dedicated team reviewed Bug 1731164 and compared it to the Baseline Requirements, concluding that the CRL issuance frequency requirement could be violated due to how fractional seconds and/or leap seconds are treated. In response, SECOM decided to reissue the Root CRLs and revised its CRL publication manual to generate CRLs in 364 days plus one second, then generated new CRLs on October 7, 2021. SECOM stated that the issue was limited to Root CRLs containing revoked intermediate data and that subscriber certificates were not impacted. The bug was proposed for closure and Mozilla indicated it would close it on 10-Nov-2021 unless additional questions were raised; the bug is marked RESOLVED with resolution FIXED.

1. 2021-09-28 SECOM generated four Root CRLs with a validity period of 365 days and 1 second.
2. 2021-10-01 SECOM decided to reissue the Root CRLs after reviewing the applicable Baseline Requirements.
3. 2021-10-05 SECOM revised its CRL publication manual to generate CRLs in 364 days plus one second.
4. 2021-10-07 SECOM generated four new Root CRLs with a validity period of 364 days and 1 second.
5. 2021-11-05 Mozilla indicated it would close the bug on 10-Nov-2021 unless additional questions were raised.

1. 2021-10-15 Secom representative — Posted an incident report describing the Root CRL validity period issue, SECOM’s review of Baseline Requirements, and the reissue/remediation timeline.
2. 2021-10-22 Secom representative — Reported there was nothing new and that SECOM would continue monitoring the bug.
3. 2021-10-29 Secom representative — Reported there was nothing new and that SECOM would continue monitoring the bug.
4. 2021-11-05 Secom representative — Proposed closure of the bug, stating there did not seem to be additional questions.
5. 2021-11-05 Mozilla representative — Said Mozilla would close the bug on next Wed (10-Nov-2021) unless there were additional questions.