Amazon Trust Services: Missing CAA check for test website certificates

Amazon Trust Services reported that, during an internal self-audit, an engineer identified that a CAA check was missed for certificates issued for its test websites on Dec 8, 2021. The issue arose during a ceremony to revoke intermediates, during which 10 certificates for test websites were created; five were revoked immediately after issuance (test revoke certificates) and five were revoked later (test valid certificates). After reviewing the validation performed on Dec 8, the team determined that a CAA check was required and had been missed. On Dec 17, 2021, Amazon Trust Services revoked the five certificates that would have been used as test valid certificates, and stated that it had stopped. The thread includes discussion that the intermediates used for these test certificates are offline and manual, and that Amazon Trust Services does not operate online intermediates for day-to-day issuance. Mozilla indicated it would close the bug on 14-Jan-2022 unless further items were needed, and Amazon Trust Services confirmed it had no further items planned. The bug is resolved as FIXED.

1. 2021-12-08 Amazon Trust Services performed an intermediates revocation ceremony and created 10 test website certificates, revoking five immediately after issuance.
2. 2021-12-16 Amazon Trust Services reviewed the Dec 8 validation and determined a CAA check was required but had been missed for the test website certificates.
3. 2021-12-17 Amazon Trust Services revoked the five test valid certificates for which the CAA check had been missed.
4. 2022-01-14 Mozilla planned to close the bug if no further items were needed.

1. 2021-12-20 DigiCert — Reported that an internal self-audit found a missed CAA check for 10 test website certificates created on Dec 8, 2021, and described the subsequent revocation of the five test valid certificates.
2. 2021-12-22 Thisisntrocket representative — Suggested using online intermediates/automation to avoid manual validation and input mistakes.
3. 2021-12-27 DigiCert — Responded that Amazon Trust Services does not operate online intermediates for day-to-day issuance and that DigiCert operates the intermediates used for day-to-day certificates.
4. 2022-01-03 DigiCert — Stated that Amazon Trust Services was monitoring the bug for feedback and had no further action items planned.
5. 2022-01-10 Mozilla representative — Said the bug would be closed on 14-Jan-2022 unless additional items needed addressing.
6. 2022-01-10 DigiCert — Confirmed there were no further items planned.