DigiCert delayed revocation following incident 1910322
This case concerns DigiCert’s delayed revocation of certificates affected by the underlying incident in bug 1910322. DigiCert opened the bug itself as a preliminary report, stating that it had intended to revoke within 24 hours but decided to delay revocation up to 120 hours after discussions with root programs and customers about impact, and after a court granted a temporary restraining order against revocation for one subscriber. DigiCert later reported that all 83,267 affected TLS certificates were revoked by 2024-08-03 20:47 UTC, and that 1,308 affected S/MIME certificates were subsequently identified and revoked by 2024-08-09. In its incident report, DigiCert said the delay occurred because 24 hours was too short for many customers to replace certificates at this scale, many customers did not see the notice in time, and DigiCert was unable to separate exceptional from non-exceptional requests before the revised deadline. The thread includes discussion about the TRO, the timing of the revocation clock, customer notification, and whether Mozilla policy permits delayed revocation; Mozilla and other participants emphasized that delayed revocation is a violation and that incident reporting procedures do not constitute permission. DigiCert stated that its action item for this bug was to implement ARI support, and later said it had informed customers that delayed revocation is not acceptable. Mozilla kept the bug open while working on updated incident-reporting and compliance guidance aimed at reducing delayed revocation. The bug is resolved FIXED.
- DigiCert filed the preliminary incident report for the underlying certificate issue in bug 1910322.
- DigiCert identified impacted certificates and notified customers that revocation would occur within 24 hours.
- DigiCert received notice that a customer had filed for a temporary restraining order against revocation.
- A court granted a TRO prohibiting revocation for a period stated in the order.
- DigiCert decided to delay revocation up to 120 hours and filed this delayed revocation bug.
- DigiCert reported all 83,267 affected TLS certificates had been revoked by 20:47 UTC.
- DigiCert identified a final list of affected S/MIME certificates.
- DigiCert reported all affected S/MIME certificates had been revoked.
- DigiCert — DigiCert opened the bug as a preliminary report, described the delayed revocation decision, and linked the underlying incident and court docket.
- DigiCert — DigiCert said all certificates had missed the 24-hour deadline and that it would later identify which unrecalled certificates did not need delay.
- Community commenter — A commenter asked DigiCert to identify the community and root program discussions it referenced.
- Verbuecheln representative — A commenter asked when DigiCert formally received the court order and whether it arrived after the 24-hour deadline.
- DigiCert — DigiCert said it received the court order at the time previously listed and that its 24-hour clock started when it had the serial numbers.
- Google representative — The Chrome Root Program described its communications with DigiCert, stating it expected BR compliance, could not grant exceptions, and did not direct a specific course of action.
- DigiCert — DigiCert reported that all 83,267 affected TLS certificates had been revoked and that 1,308 affected S/MIME certificates would be revoked by August 9.
- DigiCert — DigiCert said all affected S/MIME certificates had also been revoked.
- DigiCert — DigiCert posted a fuller incident report with summary, impact, timeline, root cause analysis, lessons learned, and an action item date later corrected to 2024-12-15.
- Mozilla representative — Mozilla said it was working on a draft policy revision regarding delayed revocations for later discussion on the dev-security-policy list.
- DigiCert — DigiCert confirmed it had made a court filing noted in the public record and confirmed the subscriber was bound by an agreement granting revocation rights, while declining to provide more TRO-specific detail beyond public filings.
- DigiCert — DigiCert said it had no additional specific ideas to accelerate revocation to 24 hours in all cases and that its only action item for this bug was implementing ARI support.
- Mozilla representative — Mozilla said the bug would remain open until at least February 1, 2025 while it continued work on incident-reporting and compliance requirements, and pointed CAs to a CCADB policy pull request.
- DigiCert — DigiCert cited Mozilla’s incident-response wiki as describing the process followed when revocation cannot be completed on time.
- Internet Security Research Group — A commenter responded that the cited wiki language does not permit delayed revocation and instead describes reporting requirements for a violation.
- DigiCert — DigiCert posted a statement from legal counsel explaining how the TRO was obtained ex parte, saying DigiCert could not disobey the court order and worked with the subscriber to vacate it after replacement certificates were issued.
- Mozilla representative — Mozilla said future legal circumstances may prevent immediate revocation and proposed draft guidance that subscriber agreements must require timely cooperation with revocation timelines and acknowledge CA obligations.
- DigiCert — DigiCert said it believed delayed revocation violates both the Baseline Requirements and Mozilla policy, while noting a long history of published procedures for when timely revocation cannot be performed.
- DigiCert — DigiCert said future updates would be posted under the DigiCert account to make clear they were official responses.
- DigiCert — DigiCert corrected that 'and the community' in its original statement was a mistake, explained its revocation clock interpretation, said the TRO covered only a single certificate, and stated it had informed customers that delayed revocation is not acceptable and there is no such thing as exceptional circumstances.
- Google representative — The Chrome Root Program said DigiCert’s recent statements about exceptional circumstances appeared contradictory and asked how Chrome’s views had been presented to customers.
- Mozilla representative — Mozilla said it would look at closing the bug during the week of March 24-28, 2025.