DigiCert: Delayed Revocation of ~5.5 hours

This case reports a delayed revocation by DigiCert affecting an initial batch of certificates. DigiCert said it discovered the issue while investigating Bug 1794050, noting that revocation occurred within 5 days of DigiCert gathering validation information, but 5 days and 5 hours after DigiCert verified which certificates were impacted. DigiCert performed a compliance sweep on Oct 5, 2022 to determine the final list of impacted certificates (118 total) and submitted a certificate problem report after grabbing certificate contact information, which it said was about 5.5 hours apart from the final sweep. DigiCert logged Bug 1794050 on Oct 6, 2022 and revoked the certificates on Oct 10, 2022. DigiCert attributed the delay to a process change where org contact information was obtained separately from when compliance confirmed the certificate issue, resulting in a five-hour delay in revocation. As remediation, DigiCert stated it changed where the revocation timeline starts, using when the SHA2 certificate fingerprint is available rather than when org information is gathered, to align internal and external problem report processes. The bug was marked RESOLVED with resolution FIXED, and Mozilla indicated it intended to close the case on Nov 4, 2022.

1. 2022-10-05 DigiCert compliance performed a sweep to identify 118 impacted certificates.
2. 2022-10-10 DigiCert revoked the affected certificates.

1. 2022-10-24 DigiCert — Created the case describing a ~5.5-hour delay between identifying impacted certificates and revocation, and outlined the remediation to start the revocation timeline when the SHA2 fingerprint is available.
2. 2022-10-31 DigiCert — Asked if there were any additional questions.
3. 2022-11-02 Mozilla representative — Stated no additional questions and that Mozilla intended to close the bug on Nov 4, 2022.