D-Trust: Notice to affected Subscriber and person filing CPR not sent within 24 hours
D-Trust reported a non-conformity with TLS BR 4.9.5 related to timely notification requirements for the person who filed a Certificate Problem Report (CPR) and affected subscribers. During the investigation into Bugzilla incident 1891225, D-Trust determined that internal email forwarding to the responsible department did not work as required, causing notifications to be delayed. The delay was attributed to changes made by Bundesdruckerei’s call and support center to internal email forwarding configurations, including a spelling mistake in the central incident email address and forwarding to an incorrect address. D-Trust stated that the delayed notifications did not delay the actual revocation of the certificates concerned. D-Trust implemented corrective actions, including changing the email address for submitting CPRs to use a D-Trust email address instead of the service provider’s address, and setting up/using its own internal email distribution list with more frequent testing. The bug was marked RESOLVED with resolution FIXED, and D-Trust asked Mozilla to check whether the incident could be closed; Mozilla indicated they would plan to close it if there were no further community comments.
- After email forwarding configuration changes, the internal central incident email address contained a spelling mistake, leading to delayed notifications.
- D-Trust began investigating Bugzilla incident 1891225 after the notification delay was identified.
- D-Trust changed the email address for submitting Certificate Problem Reports to a D-Trust email address instead of the service provider’s address.
- D-Trust completed the final incident report and ended the investigation.
- D-Trust reported that all measures were implemented and referenced a related bug for verification.
- Bdr representative — Opened a preliminary incident report stating TLS BR 4.9.5 notification requirements were not met on time due to internal email forwarding failure and that revocation was not delayed.
- Bdr representative — Stated they would publish the final incident report by 5/8/2024 at the latest.
- D-Trust — Posted the final incident report with root cause analysis, impact, timeline, and action items including replacing the service provider email address with a D-Trust email address.
- Bdr representative — Reported that all measures were implemented and asked Mozilla to check whether the incident could be closed, pointing to Bug 1896190.
- Mozilla representative — Asked for community comments and said they would plan to close the bug next week (May 27–31) if none.