Hongkong Post: Delayed revocation of TLS certificates with Certificate Policies extension problem

Hongkong Post CA faced a significant incident involving the delayed revocation of 1,176 TLS certificates due to a problem with the Certificate Policies extension. Although the CA aimed to revoke these certificates within 5 days of identifying the issue, 1,170 certificates remained unrevoked in time, raising concerns about the continuity of critical e-services for the government of Hong Kong. The delay was attributed to the manual management of certificates by subscribers and the complexities of coordinating replacements. The CA has since implemented action items to streamline the revocation process and ensure compliance with industry standards.

1. 2024-03-18 Original problem report received.
2. 2024-05-20 Revocation deadline extended to ensure completion of certificate replacements.
3. 2024-06-30 Educational materials regarding revocation requirements distributed to all customers.
4. 2025-02-26 Closure summary prepared and incident report finalized.