Certigna: ARL without reason code for recent revoked CA certificates
In March 2024, CERTIGNA generated new intermediate CA certificates to enable automation of certificate issuance, then revoked and replaced them after deciding to change their certificate profiles. The revocation reason was not included in the ARL produced after the revocation, resulting in non-compliance with Mozilla Baseline Requirements for CRL/OCSP responses for subordinate CA certificates. CERTIGNA reported that there was no impact on end-entity certificates because no certificates were issued using these CA certificates. CERTIGNA investigated the issue, updated its “ARL generation procedure” and compliance management procedure, and generated and published new ARLs with reason codes for the affected records. A community member asked for additional reporting details and noted the incident report did not fully meet expectations, including an incomplete timeline and insufficient root-cause/remediation detail. CERTIGNA later stated that all action items were implemented and operational, and the ticket was set to be closed unless further issues were discussed. The bug is marked RESOLVED with resolution FIXED.
- CERTIGNA generated four intermediate CA certificates as part of automation for certificate issuance.
- CERTIGNA revoked and replaced the four intermediate CA certificates during a key ceremony.
- CERTIGNA received an alert that its ARL records were non-compliant with Mozilla Baseline Requirements.
- CERTIGNA reviewed ARL generation requirements and updated its ARL generation and compliance management procedures.
- CERTIGNA reported that all action items were implemented and operational.
- Dhimyotis representative — Opened an incident report stating that CERTIGNA’s ARL lacked a revocation reason code for recently revoked intermediate CA certificates and described the impact, timeline, root cause, and action items.
- Community commenter — Requested clarification and additional details, including how many intermediates were created/revoked, whether full certificate details were provided, and a more complete timeline.
- Dhimyotis representative — Provided the crt.sh IDs and stated the four revoked intermediate CA certificates were generated on 2024-03-13 and revoked on 2024-03-26.
- Google representative — Commented that the report fell short of expectations, citing an incomplete timeline, formatting/template issues, and concerns about the sufficiency of the root cause and remediation.
- Dhimyotis representative — Supplied an expanded timeline and additional sections (what went well/what didn’t go well/where we got lucky) and added an extra action item to study a script for LAR profile compliance checks.
- Mozilla representative — Asked for an update to the action items in the bug.
- Dhimyotis representative — Reported that all actions were implemented and operational and that the ticket could be closed.
- Mozilla representative — Indicated the bug would be closed the next day unless issues remained to be discussed.