Actalis: Use of CRLReason Code in Certificate Revocation

Actalis faced an issue with the incorrect assignment of CRLReason codes during certificate revocations related to incidents reported in Bugzilla. Instead of using the required code #4 (superseded), the revocations were marked with #0 (unspecified) or #5 (cessationOfOperation), violating the Baseline Requirements (BRs). The root cause was identified as an outdated revocation UI that led to operator misinterpretation, compounded by a lack of formal specification from the compliance department. Remediation actions included retroactively correcting the codes, redesigning the UI for clarity, and retraining operators to ensure compliance with BRs.

1. 2024-08-22 Preliminary incident report posted acknowledging the issue.
2. 2024-09-12 Action items for remediation were outlined and progress reported.
3. 2025-01-31 Closure summary provided, confirming all action items completed.