SwissSign: Mis-Issuance of S/MIME certificates
SwissSign reported a compliance incident it discovered during an internal audit ahead of republishing its CPR document for S/MIME end-user certificate profiles. The CA found that, during its last revision, the end-user profile for LCP certificates with an organization entry had been deleted from the published CPR S/MIME, leading to mis-issuance. SwissSign opened an internal compliance incident, decided on immediate remediation, and published CPR S/MIME v3 to add the missing profile (chapter 3.3.1.2) on its repository. The CA also revoked the mis-issued certificates within the stated timeframe (latest by 2022-04-30 08:30 CEST) and informed customers, while creating and publishing this Bugzilla report and delivering certificate lists. SwissSign stated that 118,894 certificates were affected in the period from 2021-10-11 until 2022-04-24 14:00. In later updates, SwissSign reported that all certificates had been revoked by 2022-04-29 and that its review process was updated with an additional third pair of eyes to prevent recurrence. Mozilla asked whether the underlying issues were remediated, and SwissSign confirmed that steps 1–4 were remediated with the last posting. The bug is marked RESOLVED with resolution FIXED.
- SwissSign republished CPR S/MIME to include new issuing CAs, starting the period of affected certificates.
- SwissSign identified that the published CPR S/MIME was missing the LCP with organization end-user profile, triggering the mis-issuance incident disclosure.
- SwissSign conducted an internal audit, opened an internal compliance incident, and published CPR S/MIME v3 to restore the missing profile.
- SwissSign reported that all mis-issued certificates were revoked.
- SwissSign reported completion of process improvements to add an additional review step to catch the triggering mistake.
- SwissSign confirmed to Mozilla that all remediation steps were completed.
- SwissSign AG — SwissSign explained that an internal audit found the LCP with organization profile was missing from the published CPR S/MIME, and described the remediation steps including CPR S/MIME v3 republishing, revocation within 5 days, customer notification, and creation of this Bugzilla report.
- SwissSign AG — SwissSign attached certificate lists (part 1 and part 2) as part of the incident response.
- SwissSign AG — SwissSign provided a first update stating revocation of mis-issued certificates was ongoing and that certificate-list delivery was done.
- SwissSign AG — SwissSign reported a second update that all certificates had been revoked by 2022-04-29 and that the remaining remediation step (third pair of eyes) was scheduled by 2022-05-27.
- SwissSign AG — SwissSign reported a third update that it updated its review process with an additional pair of eyes to compare pre-print and published document versions and check change tickets.
- Mozilla representative — Mozilla asked whether the underlying issues had been remediated.
- SwissSign AG — SwissSign confirmed that with the last posting all steps 1–4 were remediated.