CFCA self-reported late response to Certificate Problem Reports and updated its reporting process
CFCA self-reported that it failed to respond to Certificate Problem Reports within the 24-hour timeframe required by Section 4.9.5 of the TLS Baseline Requirements. The report says CPR emails sent to CFCA’s CCADB-disclosed address were not received, and CFCA initially investigated the issue as a possible email filtering problem outside its control. CFCA later updated its incident report with new findings, including that the CPR had been sent to a Sina address and that the earlier assessment was incomplete. As remediation, CFCA implemented a web form for CPR submission, added automation to notify its team, and arranged multiple staff to check CPR mailboxes with a double-check process. The bug was closed as RESOLVED/FIXED after CFCA stated that all action items were completed and requested closure.
- A CPR was sent to CFCA’s CCADB-disclosed email address and was not responded to within 24 hours.
- CFCA filed a self-reported incident about the late CPR response.
- CFCA said it had implemented a CPR web form, automation, and updated its CP/CPS.
- The bug remained resolved with CFCA asking for closure after stating there were no further questions.
- Community commenter — CFCA opened the bug and said it had failed to respond to CPR emails within the TLS BR 24-hour requirement.
- Community commenter — CFCA posted a full incident report describing the issue as self-reported, with no certificates impacted and an action item to change the problem-reporting address.
- Community commenter — CFCA said it could access Gmail via VPN and that it was using Gmail to avoid missing notifications.
- HARICA — Dimitris Zacharopoulos suggested reviewing related incidents and considering a web form for CPR submissions.
- Google representative — Google’s Chrome Root Program recommended reviewing related incidents and tracking the action item more formally.
- Community commenter — CFCA updated the incident report, saying it found the CPR had been sent to a Sina email address and revised the report with new findings.
- Community commenter — CFCA said it had arranged two staff to check the mailbox daily and added automation to retrieve emails every four hours.
- Community commenter — CFCA reported that the web form and automation were implemented and that all action items were completed.
- CCADB representative — CCADB incident reporting asked CFCA to provide a closure report if the case was ready for closure.
- Community commenter — CFCA submitted a closure summary and requested closure of the incident.
- CCADB representative — CCADB issued a final call for comments and said the bug would be closed around 2025-07-15.
- Community commenter — CFCA asked for the bug to be closed and said it had kept its 7-day reply timing in mind.