Firmaprofesional: Incorrect publication of information for "Test Website - Revoked" URL in the CCADB

This case is an incident disclosure by Firmaprofesional regarding incorrect publication of CCADB information for the "Test Website - Revoked" URL (https://testrevokedsslev.firmaprofesional.com). The URL appeared as expired in the CCADB because the certificate configured for that revoked URL was the same certificate that had been issued and configured for the "Test Website - Expired" value. The issue was triggered by a misconfiguration in Firmaprofesional’s deployment script, which mistakenly assigned the expired certificate to the revoked test URL due to hardcoded file references and insufficient distinction between expired and revoked certificates. Firmaprofesional manually fixed the misconfiguration and later deployed a simplified Apache configuration to production. Firmaprofesional then updated deployment scripts to dynamically verify and deploy the correct certificate, implemented proactive monitoring to automatically verify correct certificates and outcomes for all test URLs, and automated issuance of certificates for the test URLs via an internal ACME endpoint using acme.sh. Mozilla requested a closure summary, and Firmaprofesional provided it; Mozilla stated it would close the incident on 28-Feb-2025, and the bug is marked RESOLVED with resolution FIXED.

1. 2024-03-25 Firmaprofesional's test certificates were issued.
2. 2024-03-26 A certificate synchronization script was deployed and test certificates were configured in Apache virtual hosts.
3. 2024-10-14 The misconfiguration was reported externally and manually fixed; PKI was made aware and the issue was corrected.
4. 2024-10-15 A simplified Apache configuration was deployed to production.
5. 2024-10-31 Deployment scripts were updated to dynamically verify and deploy the correct certificate, and proactive monitoring was set up.
6. 2025-02-02 Issuance of certificates for test URLs was automated via an internal ACME endpoint using acme.sh.
7. 2025-02-26 Mozilla indicated it would close the incident on 28-Feb-2025.

1. 2024-10-17 Logalty representative — Opened an incident report describing that the "Test Website - Revoked" URL appeared as expired in the CCADB due to the wrong certificate being applied, and provided root cause and action items.
2. 2024-10-31 Logalty representative — Confirmed the first two action items were in place: dynamic certificate verification/deployment and proactive monitoring for all test URLs.
3. 2025-02-02 Logalty representative — Confirmed the last action item was completed by automating issuance of test certificates via an internal ACME endpoint using acme.sh, and noted challenges related to EV/OV requirements.
4. 2025-02-02 Mozilla representative — Asked for a "Closure Summary" and requested attestation that all action items were completed.
5. 2025-02-03 Logalty representative — Provided the incident report closure summary, including incident description, root causes, remediation, and commitment summary, and requested closure.
6. 2025-02-26 Mozilla representative — Stated the incident would be closed on Friday, 28-Feb-2025.