Telekom Security: Revocation delay for TLS certificates with basicConstraints not marked as critical

Telekom Security faced a significant incident involving the delayed revocation of 336 TLS certificates that were issued without marking the basicConstraints as critical. The delay was attributed to the critical nature of the infrastructures relying on these certificates, which led to a decision not to enforce revocation within the required timeframe. The CA has since taken steps to sensitize customers about the importance of timely certificate replacement and has implemented self-assessments and audits to ensure compliance with revocation deadlines in the future. Despite these measures, concerns remain regarding the CA's commitment to adhering strictly to the Baseline Requirements in future incidents.

1. 2024-01-22 Affected customers were informed about the need to revoke certificates.
2. 2024-01-27 End of the 5-day period for revocation; 336 certificates were not revoked.
3. 2024-02-01 Incident report opened.
4. 2024-06-02 All affected certificates were replaced and revoked.
5. 2025-02-05 Closure summary provided for the incident.