Telia: Delayed revocation of 5 EE certificates (resolved)

This case concerns Telia’s delayed revocation of five end-entity (EE) certificates. Telia reported that it discovered the issue on 2021-10-14 and that revocation did not succeed within the expected 5-day timeframe for one of the certificates. Telia stated that it started revocation after analysis but could not reach certificate owners before the weekend, and that some certificates were used in important systems, so revoking others in time would have caused major disturbance to the Nordic community. Telia said replacement certificates were identical, and it therefore planned additional time for the five certificate owners before revoking/closing their systems, with replacements scheduled during week 43 latest 2021-10-29. Telia later confirmed successful revocation of the listed certificates and noted that one certificate had already expired and another had been revoked within the 5-day deadline. Mozilla indicated it would close the bug on 2022-02-16 unless there were questions or issues. The bug is marked RESOLVED with resolution FIXED.

1. 2021-10-14 Telia discovered an issue affecting a set of certificates and began analysis for delayed revocation.
2. 2021-10-15 Telia identified six certificates related to the issue and started revocation, but could not reach owners before the weekend.
3. 2021-10-19 Telia revoked the first affected certificate.
4. 2021-10-25 Telia replaced and revoked the second certificate.
5. 2021-10-29 Telia confirmed successful revocation of the certificates per the stated plan.
6. 2022-02-16 Mozilla planned to close the bug unless questions or issues remained.

1. 2021-10-26 Teliasonera representative — Telia described that revocation did not succeed in 5 days and provided a detailed timeline explaining the delayed revocation and remediation plan.
2. 2021-10-29 Teliacompany representative — Telia confirmed successful revocation of the specified certificates and noted which ones were already expired or revoked within the deadline.
3. 2022-02-11 Mozilla representative — Mozilla stated it would close the bug on 2022-02-16 unless there were questions or issues.