CFCA: The delay in revocation of ICA

This case involves the China Financial Certification Authority (CFCA) and a delay in the revocation of an intermediate certificate authority (ICA) due to a lack of an Extended Key Usage (EKU) extension. CFCA became aware of the issue following a report from the Chrome Root Program on September 10, 2022. The ICA was revoked on September 19, 2022, after CFCA identified the problem and took corrective actions. CFCA has since implemented new procedures to ensure timely revocation of certificates, including updates to their revocation rules and the introduction of automated reminders for certificate errors. The case has been resolved with CFCA demonstrating improvements in their processes.

1. 2022-09-19 CFCA revoked the ICA (CFCA DV OCA) due to a lack of EKU extension.

1. 2022-09-30 China Financial Certification Authority (CFCA) — Created attachment detailing the timeline and actions taken regarding the delayed revocation.
2. 2022-10-03 HARICA — Commented on the misunderstanding of the bug's focus regarding delayed CA revocation.
3. 2022-10-03 Mozilla representative — Suggested CFCA provide a different type of incident report to improve revocation response time.
4. 2023-04-28 Google representative — Confirmed no further questions from Chrome.
5. 2023-06-26 China Financial Certification Authority (CFCA) — Outlined improvements made by CFCA over the past year and requested to close the case.
6. 2023-06-28 Mozilla representative — Indicated intention to close the case unless further issues arise.