Certigna: Revocation delay for TLS certificates with Basic Constraint extension not marked as critical
This case concerns CERTIGNA TLS server certificates whose Basic Constraint extension was not marked as “Critical.” CERTIGNA reported that it had been issuing such non-conforming TLS certificates between 2023-09-15 and 2024-03-04, and that after being informed of the non-conformity on 2024-03-04, the affected certificates were not revoked within 5 days as required by the Baseline Requirements. CERTIGNA stopped producing TLS certificates after receiving and processing the alert, corrected TLS certificate profiles and updated CP/CPS (version 4.3), and then re-enabled TLS certificate issuance. CERTIGNA also notified subscribers and stated it initiated a plan to revoke and replace impacted certificates. In the thread, CERTIGNA later confirmed that all impacted certificates had been revoked, with the remaining late cases involving “Certigna Services CA” and “Certigna Wild CA” authorities, and that one health-organization certificate was revoked on 2024-04-09. The bug was resolved as FIXED.
- CERTIGNA began issuing TLS certificates where the Basic Constraint extension was not marked as “Critical”.
- CERTIGNA received and processed notice of a non-conformity regarding Basic Constraint criticality.
- CERTIGNA revoked all affected certificates as part of its incident response plan.
- CERTIGNA revoked a remaining certificate for a health organization.
- Dhimyotis representative — Created the incident report attachment stating that Basic Constraint was not marked critical and that affected certificates were not revoked within 5 days after the 2024-03-04 notification.
- Dhimyotis representative — Reported accelerated customer support and provided revocation/replace progress targets, noting remaining certificates mainly affecting essential French state or health services.
- Certigna — Confirmed that all impacted certificates had been revoked, with late cases limited to “Certigna Services CA” and “Certigna Wild CA,” and stated one health-organization certificate was revoked on 2024-04-09.
- Mozilla representative — Asked whether there were any reasons the bug/incident could not be closed.