CFCA delayed revocation of TLS certificates with non-critical basicConstraints
CFCA reported that it found 2,098 TLS certificates with a basicConstraints extension that was not marked critical, discovered during work on another incident (bug 1886135). CFCA said the affected certificates should have been revoked within 5 days under TLS Baseline Requirements, but revocation was delayed because customer notification and replacement took time. The bug tracks CFCA’s revocation progress, root-cause analysis, and remediation actions, including customer contact updates, incident-handling procedures, supervision measures, and linting improvements. CFCA gradually revoked the certificates over several months and later reported that the remaining revocations were completed on 2024-05-25. Mozilla later asked CFCA to reiterate its commitment to timely revocation and to add action items for finance- and government-related subscribers; CFCA said it would do so and later requested closure after stating that all disclosed action items were completed.
- CFCA confirmed the certificate issue and decided to stop issuing certificates.
- CFCA decided to revoke the affected certificates.
- CFCA reported that the remaining certificate revocations were completed.
- CFCA submitted a closure summary and requested the incident be closed.
- China Financial Certification Authority (CFCA) — CFCA said it found 2,098 affected certificates, had revoked 840, and expected to finish revocation as soon as possible.
- China Financial Certification Authority (CFCA) — CFCA reported 1,409 revoked and 689 still unrevoked certificates, and said it planned to finish by the end of April.
- China Financial Certification Authority (CFCA) — CFCA said it had completed revocation of 201 more certificates and had 488 still waiting.
- Community commenter — Asked what action items would prevent delayed revocation in the future and questioned whether CFCA was waiting for customer approval.
- China Financial Certification Authority (CFCA) — CFCA described additional preventive measures, including a revocation handling plan, customer training, and system improvements.
- China Financial Certification Authority (CFCA) — CFCA reported 2,062 revoked certificates, 28 expired certificates, and 8 remaining unrevoked certificates.
- China Financial Certification Authority (CFCA) — CFCA said the remaining revocation was completed on 2024-05-25.
- China Financial Certification Authority (CFCA) — CFCA updated the root-cause analysis and action items, including a commitment to revoke certificates within the required time.
- Mozilla representative — Mozilla asked CFCA to repeat its commitment to timely revocation and add action items for finance- and government-managed subscribers.
- China Financial Certification Authority (CFCA) — CFCA submitted a closure summary, said all disclosed action items were completed, and requested closure.
- Mozilla representative — Mozilla said it would close the bug the following week.