Buypass incident report: externally operated DNS tools used for domain validation

Buypass reported an incident involving TLS certificates issued after manual domain validation used externally operated DNS tools. Buypass said it learned of the problem on 2023-06-16 after reading a comment in Bugzilla, then stopped using the externally operated DNS tools the same day. The initial report identified six still-valid affected certificates, plus one certificate from the original bug, and said the last revoked certificate was revoked on 2023-06-17. Mozilla and other commenters asked for a more specific remediation plan and clarification of the DNS tooling and validation process. Buypass later said it would switch to an internal DNS resolver, filed a new incident report in bug 1872371, and stated on 2024-03-15 that there were no remaining action items in this bug. The bug was resolved FIXED.

1. 2023-06-16 Buypass stopped using externally operated DNS tools for manual domain validation.
2. 2023-06-17 The last affected certificate identified in the incident was revoked.
3. 2023-12-22 Buypass said it had stopped issuing certificates using an external DNS resolver and was switching to an internal DNS resolver.
4. 2023-12-29 Buypass registered a new incident report in bug 1872371.
5. 2024-03-15 Buypass said there were no remaining action items in this bug.

1. 2023-06-20 Buypass — Buypass opened the incident report and described the use of externally operated DNS tools for manual domain validation, the affected certificates, and the revocation timeline.
2. 2023-06-23 Google representative — Mozilla requested a revised resolution plan with more actionable detail and completion dates.
3. 2023-06-30 Buypass — Buypass said it had stopped using externally operated DNS tools and described planned internal reorganization and automation work.
4. 2023-07-21 Google representative — Mozilla asked for more specificity on the status and completion date of each remediation step.
5. 2023-07-31 Buypass — Buypass provided dates for defining changes to automation and completing automation for methods 2, 4, and 7.
6. 2023-09-29 Buypass — Buypass said it had made decisions on internal reorganization and had specified changes for automation work.
7. 2023-12-04 Buypass — Buypass said more resources had been added and the automation changes were in test, with production deployment planned by 2024-01-12.
8. 2023-12-15 Buypass — Buypass said the automation changes were deployed into production.
9. 2023-12-19 Buypass — Buypass said it was using in-house software for DNS lookups based on dnsjava.
10. 2023-12-21 Buypass — Buypass acknowledged that using an externally operated DNS tool for manual domain validation must be considered a Delegated Third Party and said it would raise the issue in the CA/Browser Forum.
11. 2023-12-22 Buypass — Buypass said it had stopped issuing certificates using an external DNS resolver and would post a new incident report by 2023-12-29.
12. 2023-12-29 Buypass — Buypass said it had registered a new bug for the new incident report, bug 1872371.
13. 2024-03-15 Mozilla representative — Mozilla asked whether any remaining action items existed or whether the bug should be closed.
14. 2024-03-15 Buypass — Buypass said there were no remaining action items and suggested closing the bug.