Izenpe: Not allowed Qualifier ID OID on Certificate Policies extension of Precertificates
This case is about Izenpe certificates that were not revoked as required after an incident involving an incorrect Qualifier ID OID on the Certificate Policies extension. In Bug 1876565, Izenpe disclosed that certificates issued in a specific date range were misissued due to including a qualifier ID on the Certificate Policies extension, and Izenpe revoked all certificates issued in that range. Later, Bug 1921254 noted that some certificates from Bug 1876565 were still alive and had not been revoked; Izenpe determined that the remaining items were precertificates that had not been finally issued. Izenpe stated that precertificates must be considered a binding commitment by the CA and therefore should have been revoked when Bug 1876565 was opened, and it revoked the affected precertificates. Izenpe also identified a root cause in its postlinting process: precertificates were not copied to the server where postlinting jobs run, so they were missed during research and revocation. As remediation, Izenpe created a task to move precertificates that have not been issued to the postlint server so they will be included in future postlinting and revocation processes. The bug was resolved as FIXED, and a closure summary requested closure after stating that the disclosed action items were completed.
- Bug 1876565 was opened and a list of certificates affected by the qualifier ID OID issue was published.
- Izenpe revoked all certificates covered by Bug 1876565.
- Bug 1921254#c9 indicated some certificates related to Bug 1876565 were still alive and not revoked.
- Izenpe identified that the remaining alive items were precertificates not finally issued and revoked them.
- Izenpe corrected its review window and revoked two additional precertificates.
- Izenpe planned to move automatically precertificates to the postlinting server.
- Izenpe reported that it successfully created a task to move non-issued precertificates to the postlint server.
- Izenpe provided a closure summary stating remediation and completion of action items.
- Izenpe S.A. — Reported a preliminary incident analysis tied to Bug 1921254 and Bug 1876565, stating that the remaining alive items were precertificates not finally issued and that all of them were revoked.
- Google representative — Asked whether the provided list of affected certificates was complete and pointed to additional examples that seemed related.
- Izenpe S.A. — Provided an incident report describing why precertificates were missed, stating they were revoked and listing an action item to move precertificates to the postlinting server.
- Izenpe S.A. — Reported that a task was successfully created to move non-issued precertificates to the postlint server and that they would be handled in future revocation processes.
- Mozilla representative — Requested a closure summary template and asked for confirmation that action items were completed.
- Izenpe S.A. — Submitted a closure summary describing the incident, root cause, remediation (moving precertificates to the postlinting server), and stating that all action items were completed.
- Mozilla representative — Indicated the bug would be closed on 28-Feb-2025 unless there were questions.