Asseco DS / Certum: Delayed revocation of SHECA cross certificate
This case concerns Asseco Data Systems S.A. (Certum) and the delayed revocation of a SHECA cross certificate. The bug is described as a continuation of bug 1823040, and Certum stated that it informed SHECA of the need to revoke the cross certificate on 17.03.2023. Certum issued a new cross certificate for SHECA on 28.03.2023 and scheduled revocation of the current cross certificate for 28.04.2023. Certum explained that revocation was delayed due to end-customer interests, noting that there were around 2–3k valid certificates and that affected systems could not be changed immediately; Certum stated the cancellation would take place no later than April 28, 2023. The thread records that the cross certificate was revoked on 04/28/2023. As corrective actions, Certum stated it would change cross-certificate contract provisions to explicitly require revocation within 7 days and require partners to inform end customers accordingly. In response to Mozilla’s reviewer questions, Certum clarified that the contract change applies to all future cross-certificate contracts and that it would inform partners directly within 7 days if circumstances justify revocation. The bug was marked RESOLVED with resolution FIXED, and Mozilla indicated it would close the bug on 24-May-2023 unless there were follow-up questions.
- Certum informed SHECA of the need to revoke the existing SHECA cross certificate.
- Certum issued a new SHECA cross certificate and scheduled revocation of the current cross certificate.
- The current SHECA cross certificate was revoked.
- Assecods representative — Opened/continued the case with a timeline and explanation for delayed revocation and proposed corrective actions including a 7-day revocation contract provision.
- Assecods representative — Stated that the revocation would take place by April 28, 2023.
- Assecods representative — Reported that the cross certificate was revoked on 04/28/2023.
- Google representative — Asked clarifying questions about the scope and meaning of the planned contract change and how it would prevent future delays.
- Assecods representative — Answered that the contract change applies to all future cross-certificate contracts and described how direct communication within 7 days and contract enforcement would address future delays.
- Assecods representative — Asked whether the bug could be closed if there were no further comments.
- Mozilla representative — Indicated the bug would be closed next Wednesday (24-May-2023) unless there were follow-up questions.