KIR: Failure to disclose intermediate certificate within 7 days in ccadb

This case concerns Krajowa Izba Rozliczeniowa S.A. (KIR) disclosing two issued intermediate CA certificates in the Common CA Database (CCADB). KIR reported that the two intermediate certificates were incorrectly disclosed in CCADB via a “case” instead of using the dedicated CCADB intermediate-certificate disclosure link. KIR said it was first notified by an email message from Rob Stradling sent to kontakt at kir.pl, and that KIR’s WebPKI team had attempted to comply with the 7-day disclosure requirement for new intermediate certificates. KIR stated the root cause was that its operational procedure for CCADB disclosure was too general and did not reference the correct disclosure procedure directly. As remediation, KIR updated its operational procedure to include detailed steps for disclosure to CCADB and disclosed the intermediate certificates using the correct procedure. In the closure summary, KIR stated that the affected certificates are now correctly disclosed in CCADB and that the action items were completed; Mozilla indicated it would close the bug on 19-Feb-2025 unless further discussion was needed.

1. 2024-09-16 Two intermediate CA certificates were issued.
2. 2024-09-25 Rob Stradling emailed KIR about the CCADB disclosure issue.
3. 2024-09-27 KIR updated its CCADB disclosure procedure and disclosed the intermediate certificates using the correct CCADB procedure.

1. 2024-09-28 Kir representative — KIR reported that two intermediate certificates were incorrectly disclosed in CCADB via case instead of the dedicated link, described the timeline and root cause, and stated the procedure was updated and the certificates were re-disclosed correctly.
2. 2024-10-07 Kir representative — KIR stated there were no further updates.
3. 2025-02-12 Mozilla representative — Mozilla requested a Closure Summary template and asked for confirmation that action items were completed.
4. 2025-02-17 Kir representative — KIR provided the Closure Summary, stating the certificates are correctly disclosed in CCADB, the root cause was the overly general procedure, and remediation included updating the procedure and training.
5. 2025-02-18 Mozilla representative — Mozilla said it would close the bug on 19-Feb-2025 unless anyone believed there were remaining items to discuss.