Hongkong Post delayed revocation incident for TLS certificates with non-critical basicConstraints
Hongkong Post CA reported a delayed revocation incident involving 46 TLS certificates issued with basicConstraints not marked as critical, referencing the related misissuance bug 1887008. The CA said 45 of the 46 affected certificates were not revoked within the required 5-day window because replacement certificates could not be coordinated quickly enough with affected subscribers, many of which were Hong Kong government bureaus, departments, and financial institutions. The CA also described a certificate issuance system bug that interfered with replacement issuance until a vendor patch was applied, and it later said it would not treat subscriber operational limitations as a reason to delay revocation in future cases. Over the course of the thread, Hongkong Post provided status updates, added action items for linting, system upgrades, customer education, and operational procedure changes, and eventually stated that all affected certificates had been revoked. The bug remained open for follow-up and closure summary discussion until Mozilla indicated it would close the incident after the final updates.
- Hongkong Post became aware of the certificate problem and began examining it with its compliance team.
- Hongkong Post confirmed that 45 of 46 affected TLS certificates had not been revoked within 5 days.
- Hongkong Post stated that all affected certificates had been revoked.
- Hongkong Post posted a closure summary and asked for the incident to be closed.
- Certizen representative — Hongkong Post filed a preliminary incident report describing 46 affected certificates and explaining that 45 were not revoked in time.
- Google representative — Ryan Dickson said the incident report had gone stale and did not meet CCADB incident-report expectations.
- Certizen representative — Hongkong Post explained the delay, said the issue was tied to its certificate issuance system, and outlined initial action items.
- Certizen representative — Hongkong Post said it was committed to the BR revocation timelines and revised its action items to include procedure updates and risk-management changes.
- Mozilla representative — Mozilla said it would close the incident on 2025-02-28 unless there were further questions or issues.