SwissSign: Missed revocation and opening Bugzilla

This case is a self-disclosure by SwissSign about a mis-issuance where SwissSign missed a revocation deadline and did not open a corresponding Bugzilla at the time. SwissSign states it became aware of the problem during root cause analysis of linked Bugzilla 1848854, where it recognized that it had not triggered its revocation process (including the step to post a Bugzilla ticket to inform the community). SwissSign reports that the mis-issuance was stopped as documented in Bugzilla 1848854, and it provides aggregate counts for the affected certificates in the linked period (total 16; 11 valid, 5 revoked, 0 expired). SwissSign says revocation was completed as posted in Bugzilla 1848854#c3. In the bug, SwissSign explains that it concentrated on solving the mis-issuance root cause and that revocation and reporting were not handled as separate, independently managed issues, leading to split responsibilities. SwissSign updated its processes and procedures, including creating a unified revocation and reporting process and retraining involved parties; it asked for closure if there were no open community questions. Mozilla indicated it was looking to close the bug on 22-Sep-2023, and the bug is marked RESOLVED with resolution FIXED.

1. 2022-10-12 SwissSign was informed about mis-issued certificates.
2. 2022-10-13 SwissSign worked on solving the root cause of the mis-issuance.
3. 2022-10-17 The last mis-issuance in the reported period occurred.
4. 2023-08-18 SwissSign completed root cause analysis and prepared this incident report bug.
5. 2023-09-20 SwissSign retrained involved parties on the unified revocation process and updated process documentation.

1. 2023-08-18 SwissSign AG — Opened the incident report, stating SwissSign missed a revocation deadline and did not open a corresponding Bugzilla, and described the timeline and certificate aggregates for the linked period.
2. 2023-08-23 SwissSign AG — Provided an updated explanation of what went wrong, stating revocation and root-cause mitigation were not handled via independent tickets, and described lessons learned and planned process changes.
3. 2023-08-30 SwissSign AG — Updated the planned steps, stating SwissSign was updating processes and procedures and expected completion by end of September 2023.
4. 2023-09-06 SwissSign AG — Gave a weekly update that SwissSign remained on course to update processes and procedures.
5. 2023-09-12 SwissSign AG — Reported trial runs were successful and provided an expected implementation timeframe for early October 2023.
6. 2023-09-20 SwissSign AG — Reported retraining of involved parties on the unified revocation process and updated process documentation, and requested closure if no community questions remained.
7. 2023-09-20 Mozilla representative — Indicated intent to close the bug on Friday, 22-Sept-2023.