Chunghwa Telecom delayed revocation incident involving 12,911 certificates
Chunghwa Telecom reported a delayed revocation incident involving certificates affected by the 2.5.29.9 SubjectDirectoryAttributes extension. The company said it discovered the issue after Bugzilla bug 1899466, stopped issuing certificates on 2024-05-23, removed the extension from later issuance, and then began revoking affected certificates in batches. It stated that 12,911 certificates were affected and that revocation could not be completed within the BR five-day window because many subscribers were government agencies that needed official-document approvals and vendor coordination. Mozilla and other commenters repeatedly asked for per-subscriber detail, a clearer root-cause analysis, and action items showing how future revocations would be completed on time. Chunghwa Telecom later said it would emphasize BR/CPS revocation deadlines in its user agreement, encourage dedicated networks or private encryption methods for critical infrastructure, and stop granting grace periods for similar future incidents. The company reported that all affected certificates were eventually revoked or expired, and Mozilla later said it would close the bug.
- Chunghwa Telecom stopped issuing certificates containing the controversial 2.5.29.9 extension and resumed issuance without it.
- Chunghwa Telecom filed a delayed revocation incident report for 12,911 affected certificates.
- Chunghwa Telecom said all affected certificates were revoked or expired.
- Mozilla said it would close the bug.
- Cht representative — Chunghwa Telecom opened the incident report, said the issue came from use of a controversial 2.5.29.9 extension, and said it would revoke affected certificates in batches.
- Cht representative — Chunghwa Telecom said 12,911 certificates were affected and that it could not meet the five-day revocation deadline because of subscriber coordination and government approval processes.
- Community commenter — Mozilla asked why no preliminary incident report was filed immediately and requested per-subscriber rationale for delayed revocation.
- Cht representative — Chunghwa Telecom said it had discovered the oversight, would make up the report, and described remedial measures including user-agreement changes and training.
- Cht representative — Chunghwa Telecom summarized three reasons for delayed revocation and said the revocation rate had reached 99.90%.
- Cht representative — Chunghwa Telecom said it would add BR deadlines to the user agreement and described claimed harms to government services if revocation happened immediately.
- Cht representative — Chunghwa Telecom said it would emphasize BR/CPS deadlines in the user agreement, promote dedicated encryption methods, and aim for no further delayed revocations from July 1, 2025.
- Cht representative — Chunghwa Telecom said it would not delay future revocations after updating or notifying the user agreement and would establish a new action-item schedule.
- Cht representative — Chunghwa Telecom said all certificates related to the incident had been revoked and that five airport-related certificates would not be revoked again because they were used for passenger information websites, not aviation control systems.
- Mozilla representative — Mozilla said it would close the bug on 2025-02-12.