Google Trust Services: Failure to send preliminary report to subscriber within 24h

Google Trust Services reported that, during a routine review of Certificate Problem Reports (CPRs), it discovered that a required preliminary response was sent to the incorrect recipient. The CA stated that no sensitive information was included in the response, and that after discovering the issue it sent the associated response to the correct recipient. The CA said this introduced a delay that resulted in the preliminary report being beyond the 24-hour response window required by BR 4.9.5. The CA also stated it did not stop certificate issuance because the incident did not produce misissued certificates, and it found no issues with the certificate mentioned in the CPR. To remediate, Google Trust Services implemented a guided CPR processing tool to ensure correct information is sent to the correct parties, and it added a two-person review of CPR responses sent during business hours as a preventative measure. The CA reported that no further issues have occurred since the incident and requested closure if there were no questions.

1. 2022-07-31 A certificate was issued.
2. 2022-07-31 A CPR inquiry was received via the pki.goog contact form.
3. 2022-08-02 During a review, the CA discovered the correct subscriber had not received the findings report and sent it.
4. 2022-09-02 The CA completed implementation of a guided CPR processing tool and reported preventative process changes.

1. 2022-08-04 Community commenter — Google Trust Services explained that a preliminary CPR response was sent to the incorrect recipient, causing the 24-hour BR 4.9.5 window to be missed, and described the corrective actions and investigation.
2. 2022-08-10 Community commenter — The CA stated it was actively working on a guided CPR processing tool and would provide an update by September 2, 2022.
3. 2022-09-02 Community commenter — The CA reported the guided CPR processing tool was implemented and in active use, described a two-person review during business hours, and requested closure if no questions remained.
4. 2022-09-07 Mozilla representative — Mozilla indicated it would close the bug on or about 9-9-2022 unless questions or issues remained.