GDCA: CRL validity period exceeds allowed value by one second

GDCA reported that its CRLs had a validity period that exceeded the allowed value by one second. The CA said it noticed the issue after other CAs reported similar CRL validity problems on Bugzilla, and it confirmed that its trusted root certificate CRL was issued with a validity period of twelve months plus one second, which it stated violates Baseline Requirements section 4.9.7. GDCA also stated that subscriber certificate CRLs were valid for 48 hours plus one second, which it said violated its CPS section 4.9.7, and it checked OCSP response validity as well. In response, GDCA informed its WebTrust auditor and decided to re-issue the root CRL with an appropriate validity period, and to revise its CPS wording for CRL issuance frequency and the nextUpdate field. The CA reported re-issuing and publishing the root CRL, and later updated its CP/CPS on November 1, pointing to changes in sections 2.3 and 4.9.7 related to CRL issuance frequency. Mozilla indicated it would close the bug on or about November 4, 2021 unless there were additional questions, and the bug is marked RESOLVED with resolution FIXED.

1. 2021-07-15 GDCA issued the CRL for its trusted root certificate with a validity period of twelve months plus one second.
2. 2021-10-22 GDCA confirmed that its root and subscriber CRL validity periods violated the Baseline Requirements and its CPS, respectively.
3. 2021-10-25 GDCA informed its WebTrust auditor and decided to re-issue the root CRL and revise its CPS wording.
4. 2021-10-29 GDCA re-issued and published the root CRL with an updated validity period.
5. 2021-11-01 GDCA updated its CP/CPS to revise CRL issuance frequency and nextUpdate constraints.

1. 2021-10-28 Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) — GDCA described how it became aware of the CRL validity period issue and provided a timeline and stated compliance violations for root and subscriber CRLs.
2. 2021-10-29 Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) — GDCA reported that it re-issued and published the root CRL and provided the updated validity period.
3. 2021-11-02 Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) — GDCA stated it updated its CP/CPS on November 1 and believed the proposed remediation steps were completed.
4. 2021-11-02 Mozilla representative — Mozilla said it would close the bug on or about Thursday, 4-Nov-2021 unless there were additional questions or concerns.