ACCV: Delayed revocation of TLS certificates affected by bug #1884532
This case reports a non-compliance with BR point 4.9.1.1.1 related to delayed revocation of TLS certificates associated with the earlier incident in bug #1884532. ACCV stated that certificates were revoked after the required deadline, and that all certificates affected by the original incident are also affected by this delayed-revocation incident. ACCV explained that although it was in a position to revoke within five days, the delay in processing the notification meant the full revocation process took more than five days. ACCV’s timeline states that the issue was detected after a routine review on 2024-03-09 08:30 UTC and that all certificates were revoked on 2024-03-14 08:30 UTC. As remediation, ACCV opened a CCADB case to modify the email address used for communications from the Problem Reporting Mechanism, changing it from a**********v@accv.es to p**********g@accv.es, pending and then receiving confirmation from the root store reviewer. The bug was marked RESOLVED with resolution FIXED, and ACCV indicated no further action was pending while monitoring the bug until closure.
- An external observer emailed a**********v@accv.es about a possible issuance problem, which was not treated as urgent and was routed for routine review.
- After routine review, ACCV detected a warning involving incorrectly issued certificates.
- ACCV revoked all certificates affected by the delayed revocation incident.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Opened a preliminary incident report stating non-compliance with BR 4.9.1.1.1 due to certificates revoked after the deadline, and described impact, timeline, root cause, and an action item to adjust the Problem Reporting Mechanism email address.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Reported that ACCV opened a CCADB case to modify the Problem Reporting Mechanism email address from a**********v@accv.es to p**********g@accv.es, pending root store reviewer confirmation.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Confirmed the reviewer approved the mechanism and that the new email address is p**********g@accv.es.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Stated no further action was pending and that ACCV was monitoring the bug for comments or questions.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Stated no further action was pending and that ACCV was monitoring the bug until it was closed.
- Community commenter — Asked whether the original report was preliminary or final.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Confirmed the report is final and apologized for mistakenly labeling it preliminary in the template.
- Mozilla representative — Asked whether there was any reason the bug/incident cannot be closed.