Actalis: revocation delay for certificates issued with invalid RDN Order
Actalis reported a revocation delay related to a mis-issuance incident involving 263 EV certificates. After receiving an independent report, Actalis learned of the mis-issuance described in bug 1883731 and determined it would revoke the affected certificates within 5 days after confirmation, even though the revocation start was supposed to begin on the date it received the problem report. Actalis stated that the revocation delay impacted 263 certificates. The company completed revocation on 2024-03-15 and posted both a preliminary update and a complete incident report on Bugzilla. Actalis attributed the delay to its internal revocation-handling process, which it said did not result in compliance with the Baseline Requirements timing in Section 4.9.1.1. Actalis also listed action items to revise incident management processes and increase internal training, and later reported that all actions were successfully completed by the May 1, 2024 deadline. The bug is marked RESOLVED with resolution FIXED.
- Actalis received an email reporting a potential issue affecting an EV certificate.
- Actalis confirmed the mis-issuance and decided to revoke all affected certificates within 5 days.
- Actalis revoked all affected certificates.
- Actalis posted a complete incident report on Bugzilla.
- Actalis reported completion of the incident-management and training action items.
- Staff representative — Actalis posted an incident report describing a revocation delay for 263 misissued EV certificates and provided root cause analysis and action items.
- Staff representative — Actalis stated there were no further updates at that time.
- Community commenter — A commenter asked whether there was an update on the action items due by 2024-05-01.
- Staff representative — Actalis reported that all action items were successfully completed by the May 1, 2024 deadline.
- Mozilla representative — Mozilla asked whether the bug/incident could be closed.