DigiCert delayed revocation for certificates from bug 1894560
This case concerns DigiCert’s delayed revocation of certificates tied to bug 1894560. DigiCert said the affected certificates had an incorrect businessCategory value and could not all be revoked within the Baseline Requirements’ five-day window. The company initially reported that it had revoked 7,138 certificates on May 11, 2024, with 3,788 still delayed, and it continued posting updated counts and timelines as revocations progressed. The thread also discussed the reasons DigiCert accepted for delay, including critical infrastructure impacts, automation problems, regulatory or government approval processes, and other subscriber-specific constraints; DigiCert said pinning was not accepted as a reason. By late June 2024, DigiCert said all certificates were revoked. The later discussion focused on remediation and policy interpretation, including updates to customer guidance, internal incident-response changes, and deployment of ARI.
- DigiCert opened a delayed revocation report for certificates affected by bug 1894560.
- DigiCert revoked 7,138 certificates and reported 3,788 still delayed past the five-day deadline.
- DigiCert said it had revised the timeline so all remaining certificates would be revoked by the end of June.
- DigiCert said all certificates were revoked.
- DigiCert posted a closing statement listing completed remediation and prevention action items.
- DigiCert — DigiCert filed a preliminary delayed revocation report and said it would follow up with a full list of delayed certificates, reasons, and proposed revocation dates.
- DigiCert — DigiCert said it revoked 7,138 certificates and attached an update file for the remaining delayed certificates.
- DigiCert — DigiCert posted a breakdown of remaining certificates and the subscriber-reported reasons for delay, including automation, critical infrastructure, and regulatory issues.
- DigiCert — DigiCert said pinning was not accepted as a delay reason, explained its use of a critical-infrastructure framework, and posted a properly formatted incident report.
- DigiCert — DigiCert said it had revised the timeline to revoke all certificates by the end of June and that it had informed subscribers.
- DigiCert — DigiCert said all certificates were revoked and stated that some delays were due to broken automation and others were revoked after Google’s response to delay.
- DigiCert — DigiCert said it had completed all action items, including revoking impacted certificates, updating customer guidance, deploying ARI, and revising internal policies.