← SSL.com cases
Bugzilla #1938236
Incident
Revocation Issue
SSL.com: Failure to process CAA records from one SubCA
RESOLVED
FIXED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SSL.com identified a compliance issue related to the failure to process CAA records for a CA certificate, affecting 57 TLS certificates, 7 of which were still active. This issue was discovered during a retroactive verification of post-ceremony actions as part of a previous bug. SSL.com remediated the issue by revoking the active certificates within 24 hours of discovery and submitted a preliminary incident report. A final incident report detailed the root cause, which included misconfiguration and peer review failures. SSL.com has since updated its documentation and processes to prevent future occurrences, and all action items have been completed.
Chronology
- SSL.com submitted a preliminary incident report after discovering a CAA configuration issue.
- SSL.com submitted a final incident report detailing the root cause and remediation steps.
- Mozilla plans to close the bug unless further issues arise.
Thread Activity
- SSL.com — SSL.com identified a CA certificate without proper CAA validation and reported 57 affected TLS certificates.
- SSL.com — Final incident report submitted, detailing the root cause and remediation actions.
- SSL.com — Incident report closure summary provided, confirming completion of all action items.
- Mozilla representative — Mozilla indicated plans to close the bug unless further issues arise.
Participants
SSL.com
Mozilla representative
External References
Similar Local Cases
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: Delay in publishing OCSP responses
SSL.com: CAA Empty set handling results in Wildcard issuance
SSL.com: Expired certificate for a “Valid” Test Website
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
SSL.com: Issuance of 1 EV TLS certificate using a Registration/Incorporation Agency not included in our approved public list.
SSL.com: Issuance of certificates using keys previously reported as compromised
SSL.com: Incorrect Open MPIC Lambda implementation by EJBCA ACME Service