Hongkong Post delayed revocation incident for TLS certificates affected by Certificate Policies extension problem

Hongkong Post reported that 1,176 TLS certificates were affected by a Certificate Policies extension problem, and that 1,170 of them were not revoked within the required 5 days. The CA said it had been working with subscribers to replace the certificates, but some customers could not complete replacement in time because the certificates supported critical government services. The thread focused on the delayed revocation itself, the progress of revocation, and the CA’s remediation and prevention steps. Hongkong Post later reported that all affected certificates were revoked on 2024-05-29. The CA also added and completed action items covering linting improvements, customer education, revocation procedures, and communication practices. Mozilla later said the bug would remain open until at least 2025-02-01, and the CA posted a closure summary on 2025-02-26.

1. 2024-03-18 Hongkong Post received the original problem report about the certificate policies extension issue.
2. 2024-03-20 Hongkong Post confirmed the issue as a misissuance and identified all affected TLS certificates.
3. 2024-05-29 Hongkong Post reported that all affected certificates had been revoked.
4. 2025-02-26 Hongkong Post posted a closure summary stating that all action items had been completed.

1. 2024-03-21 Certizen representative — Hongkong Post filed a preliminary incident report saying 1,170 of 1,176 affected certificates were not revoked in time and proposed completing revocation by 2024-05-20.
2. 2024-05-01 Google representative — Ryan Dickson said the incident report had gone stale and did not meet CCADB incident-report expectations.
3. 2024-05-03 Certizen representative — Hongkong Post said 841 affected certificates had been revoked and 41 remained outstanding.
4. 2024-05-17 Certizen representative — Hongkong Post reported 1,079 revoked certificates and proposed extending the revocation deadline to 2024-05-31.
5. 2024-05-20 Certizen representative — Hongkong Post said 1,090 certificates had been revoked and listed action items to address the incident and future revocation delays.
6. 2024-05-31 Community commenter — A commenter said all certificates appeared to be revoked, with the last five occurring on 2024-05-29.
7. 2024-06-07 Certizen representative — Hongkong Post said action item 5 was done and that it would provide another update by 2024-06-17.
8. 2024-06-21 Certizen representative — Hongkong Post added action items 8 and 9 to update operating procedures and the risk management plan.
9. 2024-06-30 Certizen representative — Hongkong Post said action items 6 through 9 were done and that it would continue monitoring the bug.
10. 2025-02-11 Mozilla representative — Mozilla asked Hongkong Post to repeat its commitment to timely revocation and add action items addressing government-managed subscribers and external policy constraints.
11. 2025-02-14 Certizen representative — Hongkong Post reiterated its commitment to timely revocation and said new application procedures had been established to prevent external policies from obstructing revocation.
12. 2025-02-26 Certizen representative — Hongkong Post posted a closure summary saying all action items were complete and asked for the incident report to be closed.