TWCA: Undisclosed CA
Mozilla’s Root Store Policy requires CCADB disclosure of new subordinate CAs within one week of certificate creation. In this case, Mozilla identified that a subordinate CA certificate for “TWCA Secure SSL Certification Authority” (new CA certificate not-before 2023-04-13) had not been disclosed in CCADB within the required timeframe. TWCA confirmed that the certificate was a new generation of the same CA and stated that it had uploaded the CA certificate to CCADB and began investigating after receiving notice from Bugzilla. TWCA also reported that it switched TLS certificate issuance to the new CA key and certificate on 2023-08-10, then switched issuance back to the old CA certificate and stopped using the new CA certificate on 2023-08-11. TWCA later revoked the CA certificate on 2023-08-17 (referencing Bug 1848306) and stated it had stopped issuing certificates from the problematic CA certificate immediately. TWCA said it was revising its SOP to ensure CCADB disclosure is confirmed by compliance staff, and later reported that checklists for CA lifecycle operations had been completed. The bug was resolved as FIXED.
- TWCA issued a new CA certificate for “TWCA Secure SSL Certification Authority” to replace the prior CA certificate.
- TWCA switched its TLS certificate issuance system to use the new CA key and certificate.
- TWCA uploaded the new CA certificate to CCADB and switched certificate issuance back to the old CA certificate, stopping use of the new CA certificate.
- TWCA revoked the CA certificate.
- TWCA reported that its CA lifecycle checklists had been completed.
- Mozilla representative — Ben Wilson reported that a subordinate CA certificate appeared not to be disclosed in CCADB within one week of certificate creation and requested an Incident Report per MRSP.
- Taiwan-CA Inc. (TWCA) — Hao-Chun Li confirmed the certificate was the new generation of the TWCA Secure SSL Certification Authority, uploaded it to CCADB, and started investigating.
- Taiwan-CA Inc. (TWCA) — Hao-Chun Li submitted an Incident Report describing the timeline, stating issuance was stopped, and explaining the SOP/communication gaps and remediation steps.
- Taiwan-CA Inc. (TWCA) — Hao-Chun Li posted a Final Incident Report, including that the CA certificate was revoked on 2023-08-17 and that the report was being posted.
- Mozilla representative — Ben Wilson asked when TWCA’s checklists would be completed so the matter could be closed.
- Taiwan-CA Inc. (TWCA) — Hao-Chun Li stated the checklists had been completed and described their scope across CA lifecycle operations.
- Mozilla representative — Ben Wilson said he would close the matter on or about 2023-11-01 unless there were concerns.