KIR: Delayed revocation within seven (7) days for bug 1921598

Krajowa Izba Rozliczeniowa S.A. (KIR) reported a delayed revocation of the SZAFIR Trusted CA3 Intermediate CA certificate, which lacked the required Reserved Certificate Policy Identifiers for compliance with S/MIME Baseline Requirements. The revocation was not completed within the mandated seven-day period, leading to an incident report. KIR acknowledged the delay was due to critical infrastructure outages and complexities in their operational processes. A remediation plan was initiated, including the issuance of a new CA certificate and a user migration plan. As of March 2025, KIR confirmed that the affected certificate had been revoked and that they have implemented new policies to prevent future delays.

1. 2024-10-03 KIR posts a preliminary incident report regarding delayed revocation.
2. 2025-03-05 KIR revokes the affected certificate.
3. 2025-03-17 KIR submits a closure summary for the incident.

1. 2024-10-03 Kir representative — KIR posts a preliminary report indicating delayed revocation.
2. 2024-10-11 Kir representative — KIR provides an incident report detailing the impact and timeline of the revocation delay.
3. 2025-03-17 Kir representative — KIR submits a closure summary, acknowledging the delay and outlining new policies.