certSIGN: Delayed response to CPR
certSIGN reported a delayed response to a Certificate Problem Report (CPR). The CA stated it failed to receive an email containing the CPR because the message was marked as junk by its Office 365 email filter, so it did not respond within the required timeframe. certSIGN later received the same CPR from a different sender address that was not marked as junk, acknowledged it, and began investigating. After acknowledging the CPR, certSIGN revoked the non-conformant certificate within the maximum period of 5 days. The CA also documented lessons learned and corrective actions, including checking the junk and spam folders as part of routine email checks and training responsible staff on the problem reporting mechanism. The bug was marked RESOLVED with resolution FIXED, and certSIGN stated there were no additional actions unless further questions arose.
- An email containing a CPR was received but was marked as junk by Office 365, delaying certSIGN’s response.
- The same CPR was received from a different sender not marked as junk, prompting investigation and acknowledgment.
- certSIGN informed WebTrust auditors about the incident and registered the incident report in Bugzilla.
- certSIGN stated it revoked the non-conformant certificate within 5 days after acknowledging the CPR.
- certSIGN reported internal review and added daily junk/spam folder checks to routine email checking, closing action items.
- certSIGN — Opened the incident report, stating the CPR email was missed because it was marked as junk and that the due-time acknowledgment did not occur.
- certSIGN — Reported that the non-conformant certificate was revoked within 5 days of acknowledging the CPR.
- certSIGN — Described an internal meeting and stated the main corrective action was daily checks of junk/spam folders, with action items closed.
- certSIGN — Stated there were no additional actions and the bug could be considered resolved unless further questions arose.
- certSIGN — Reiterated there were no additional actions and the bug could be considered resolved unless further questions arose.
- Mozilla representative — Indicated the case could be closed May 20–24 if questions about the junk email filter/folder were answered in Bugzilla Bug #1886627.