KIR: Failure to disclose intermediate certificate within 7 days in CCADB
This case concerns Krajowa Izba Rozliczeniowa S.A. (KIR) disclosing two issued intermediate CA certificates in the Common CA Database (CCADB). KIR reports that the intermediate certificates were incorrectly disclosed in CCADB via a case instead of using the dedicated CCADB disclosure link. KIR states it was first notified by an email from Rob Stradling to k**********t@kir.pl, and that KIR’s WebPKI team began a preliminary investigation after receiving the message. KIR says the affected certificates were ultimately correctly disclosed in CCADB using the correct procedure, and provides certificate references and a CCADB intermediates link. KIR also reports updating its operational procedure for CCADB disclosure to include detailed steps and updating training for the WebPKI team to prevent recurrence. The bug was closed as INVALID, with KIR indicating they opened the same issue under a different bug ID.
- Two intermediate CA certificates were issued by KIR.
- Rob Stradling emailed KIR about the CCADB disclosure issue.
- KIR updated its CCADB disclosure operational procedure and disclosed the intermediate certificates using the correct CCADB procedure.
- Kir representative — KIR described that two intermediate certificates were disclosed in CCADB via case instead of the dedicated link, noted notification by Rob Stradling, stated the certificates were later correctly disclosed, and reported procedure and training updates.
- Kir representative — KIR asked to close the bug and said they opened the same issue with the correct type at https://bugzilla.mozilla.org/show_bug.cgi?id=1921596.