← e-commerce monitoring GmbH cases
Bugzilla #1862004
Delayed Revocation
e-commerce monitoring GmbH: Delayed revocation
RESOLVED
WONTFIX
e-commerce monitoring GmbH
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The case involves e-commerce monitoring GmbH's failure to revoke multiple certificates within the required timeframe after a misissuance incident. The CA was required to file a separate incident report detailing the factors that led to the delay and the actions taken to prevent future occurrences. The incident report was criticized for lacking sufficient detail and action items. As of June 30, 2024, e-commerce monitoring GmbH will be removed from browser root programs due to these compliance issues, although previously issued certificates will remain valid. The CA has acknowledged the shortcomings and is committed to restructuring its processes to regain compliance.
Chronology
- e-commerce monitoring GmbH issued multiple signed data structures with a duplicate serial number.
- e-commerce monitoring GmbH will be removed from browser root programs.
Thread Activity
- Mozilla representative — This bug is required as a follow-up to Bug # 1815534. The CA is required to file a separate incident report for the delayed revocations mentioned there.
- e-commerce monitoring GmbH — We will provide updates to this bug no later than Friday 16th.
- e-commerce monitoring GmbH — Browsers have decided to remove e-commerce monitoring GmbH from their Root Programs as of June 30, 2024.
Participants
Mozilla representative
Zeger representative
Google representative
e-commerce monitoring GmbH
Internet Security Research Group
Community commenter
External References
Similar Local Cases
TWCA: Revocation delay for TLS certificates with non-critical basicConstraints
Telekom Security: Revocation delay for TLS certificates with basicConstraints not marked as critical
eMudhra emSign PKI Services: Delayed Revocation of SSL/TLS Certificates
Entrust: Delayed revocation of EV TLS certificates with missing cPSuri
Entrust: Delayed revocation of certificates affected by Jurisdiction issue in some EV TLS & Code Signing certificates
Digicert: Delayed Revocation for bug 1894560
NETLOCK: CPR was not responded to in 24 hours
Telia: Delayed revocation of seven (7) certificates related to incident 1896108