SwissSign: EV delayed revocation

SwissSign AG reported a delayed revocation of 40 EV certificates due to customer requests that extended beyond the mandated 5-day period. The decision was influenced by the nature of the mis-issuance, which was compliance-related and did not pose security risks. Affected customers included critical infrastructure entities, such as a hospital and a bank, which had emergency processes in place for certificate replacement. The revocation was ultimately completed by the specified deadlines, and the incident was documented as a violation of CA/B Baseline regulations.

1. 2023-10-23 Compliance incident raised leading to Bugzilla 1860750
2. 2023-10-27 Decision taken by Compliance team for individual customer cases
3. 2023-11-06 Revocation of 33 certificates completed
4. 2023-11-13 Revocation of 3 certificates completed
5. 2023-11-17 Revocation of 4 certificates completed, all affected certificates revoked