CFCA: Delayed reporting of revocation of an intermediate CA certificate
This case concerns CFCA’s reporting of the revocation status for an intermediate CA certificate in CCADB. Mozilla noted that CFCA did not report the revocation of the intermediate certificate “CFCA DV OCA” within 7 days as required by section 4 of the CCADB Policy. CFCA stated that the intermediate certificate was revoked on 2022-09-19, but CCADB was updated later. In response, CFCA re-uploaded the old intermediate certificate to CCADB and marked it as revoked on 2022-11-08, after previously uploading and marking it revoked on 2022-11-07/2022-11-08 per the timeline provided. CFCA also described remediation steps related to incident handling, CCADB operations, and work handover to prevent similar issues. The bug is marked RESOLVED with resolution FIXED.
- CFCA revoked the intermediate certificate CFCA DV OCA.
- CFCA re-uploaded the old intermediate certificate to CCADB and marked it as revoked.
- Mozilla representative — Reported that CFCA did not update CCADB to mark the intermediate certificate as revoked within 7 days per the CCADB Policy.
- China Financial Certification Authority (CFCA) — Provided a timeline explaining when the intermediate certificate was revoked and when CCADB was updated/marked as revoked, and described related process steps.
- Google representative — Asked CFCA how it plans to collect/apply lessons learned, how CCADB operation review is handled, and how work handover will prevent missed items.
- China Financial Certification Authority (CFCA) — Answered with details on analyzing Bugzilla incident reports, planned Zlint automation, subscribing to CA Certificate Compliance components, CCADB login/review practices, and handover controls.
- Mozilla representative — Indicated an intention to close the bug on or about Wed. 19-APR-2023.