DigiCert: Delayed revocation of IV certificates
This case concerns DigiCert’s delayed revocation of some IV certificates. DigiCert said it found an issue with IV certificates referenced in Bug 1845634 and, after notifying customers of the obligation to revoke and replace, detected anomalies in its data pull and reviewed them manually, which DigiCert said caused it to miss the original revocation timeline. DigiCert also stated that a customer (Beckton Dickinson) requested an extension of the mandated 5 days due to difficulties replacing certificates within that timeframe on sensitive machines not using automation. DigiCert decided to delay revocation by about three weeks and sent notices to end users, with a revocation deadline set for 15:00 30 July 2023 and later adjustments discussed for two specific certificates used to communicate with the FDA and other regulatory bodies. DigiCert reported that all certificates other than the two listed were revoked on 17 Aug 2023, and that it revoked the final two certificates on 23 Aug 2023. Mozilla indicated it would close the bug on or about 1 Sept 2023, and the bug is marked RESOLVED with resolution FIXED.
- DigiCert began investigating IV certificate data after noticing a company-like name in a list of IV certificates.
- DigiCert finalized the list of potentially impacted certificates and sent notices to end users.
- DigiCert revoked all certificates except two specified certificates.
- DigiCert revoked the final two certificates.
- Community commenter — DigiCert described how it became aware of the issue, said manual review caused it to miss the original revocation timeline, and requested a delay in revocation while rolling out automation tools.
- Community commenter — DigiCert reported that Becton Dickinson was on track to replace most certificates and requested pushing back revocation for two certificates to 26 Aug due to manual approval and coordination needs.
- Community commenter — DigiCert confirmed all certificates other than the two listed were revoked and stated it remained on track to revoke the remaining two by 26 Aug.
- Community commenter — DigiCert stated it revoked the final two certificates and asked whether the bug could be closed.
- Mozilla representative — Mozilla said it would close the bug on or about Friday 1-Sept-2023 unless there were questions or issues.