← SSL.com cases
Bugzilla #1800753
Delayed Revocation
SSL.com: Delayed revocation of certificate with weak key
RESOLVED
WONTFIX
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns SSL.com's delayed revocation of a certificate containing keys vulnerable to Fermat factorization. The certificate was revoked 25 hours and 50 minutes after SSL.com was made aware of the vulnerability, which is outside the required 24-hour revocation timeframe for such issues as per the Baseline Requirements. SSL.com acknowledged the delay and explained that they needed to analyze the situation before proceeding with revocation. They also indicated that the current guidelines lack clarity on what constitutes a 'demonstrated or proven method' for key compromise. The case has been resolved with SSL.com committing to improve their processes and monitoring for similar vulnerabilities in the future.
Chronology
- Certificate with weak key was revoked.
Thread Activity
- Thisisntrocket representative — Reported the delayed revocation of a certificate with weak key.
- SSL.com — Acknowledged receipt of the bug report and planned to respond.
- SSL.com — Explained the rationale for the delayed revocation and outlined steps taken to address the issue.
- Mozilla representative — Indicated that the underlying issues have been adequately addressed.
- Mozilla representative — Closed the bug as the issues are being addressed by the CA/Browser Forum.
Participants
Thisisntrocket representative
SSL.com
Mozilla representative
External References
Similar Local Cases
SSL.com: Delayed revocation of 53 certificates affected by bug #1750631
Asseco DS / Certum: Delayed revocation of SSL.COM cross certificate
IdenTrust: Delay beyond 5 days in revoking misissued certificates
Sectigo: ZeroSSL: failure to revoke within 24 hours
Firmaprofesional: Failure to revoke ICAs within 7 days: OCSP EKU
Camerfirma: Delayed revocations of certificates issued by old CAs with an RSA modulus size of 2047 bits
Let's Encrypt: Failure to revoke key-compromised certificate within 24 hours
DigiCert: Failure to revoke key-compromised certificates within 24 hours