Buypass: TLS certificates not revoked within 5 days

Buypass reported an incident involving the delayed revocation of 591 TLS certificates that were not revoked within the required 5-day timeframe after a compliance issue was identified. The CA acknowledged the violation of Baseline Requirements due to the high number of affected certificates and the complexity of the revocation process, which involved manual actions by subscribers. Over time, Buypass managed to revoke 590 of the certificates, with the last one revoked on January 15, 2024. The CA has committed to improving its processes to prevent future delays, including engaging with the CA/Browser Forum to discuss potential changes to revocation timelines for low-impact errors.

1. 2023-11-10 Original error identified involving 591 certificates.
2. 2024-01-15 Last of the affected certificates revoked.

1. 2023-11-17 Buypass — Incident report created detailing the failure to revoke certificates within 5 days.
2. 2023-11-24 Buypass — 576 out of 591 certificates revoked; 15 certificates pending revocation.
3. 2024-01-08 Buypass — Acknowledged long revocation times and committed to improving processes.
4. 2024-01-15 Buypass — Confirmed all affected certificates have now been revoked.
5. 2024-04-03 Mozilla representative — Indicated that the incident can be closed as all remediation items are completed.