KIR: SZAFIR Trusted CA3 revocation status not updated in CCADB within 7 days
Krajowa Izba Rozliczeniowa S.A. (KIR) revoked the subordinate/intermediate certificate “Szafir Trusted CA3” on March 5, 2025 as part of its planned decommissioning schedule. The revocation status was not updated in the CCADB within the 7-day window required by Section 6 of the Chrome Root Program Policy and by the CCADB Policy (Section 4 for subordinate CA certificates). The issue was first noticed and reported by the Chrome Root Program (CRP) Team, and KIR stated that the delay affected the CCADB status update. KIR reported that it updated its operational procedure for disclosing/updating CCADB statuses on May 13, 2025, and that WebPKI team training was completed by May 19, 2025. KIR also introduced routine monthly checks of CCADB entries and checks after significant PKI changes, completed by May 21, 2025. The bug was resolved as FIXED, and KIR requested closure stating that all action items had been completed.
- KIR revoked the Szafir Trusted CA3 certificate as part of its planned decommissioning schedule.
- KIR’s WebPKI team began investigating after notification from the Chrome Root Program Team.
- KIR updated its operational procedure for disclosing/updating CCADB statuses.
- KIR completed training for WebPKI team members on the updated operational procedure.
- KIR completed implementation of routine monthly CCADB entry reviews and checks after significant PKI changes.
- Kir representative — KIR provided a preliminary incident report stating the subordinate certificate revocation was not updated in CCADB within the required timeline and that a full incident report would follow.
- Kir representative — KIR submitted the full incident report, describing the non-compliance period, stating the issue was first noticed by the Chrome Root Program Team, and identifying the root cause as a CCADB update failure due to an overly general internal procedure.
- Google representative — The Chrome Root Program commented that the incident report needed updates (e.g., more complete policy references, timeline details, and related incidents) and asked for improvements to the root cause and action items sections.
- Kir representative — KIR responded by updating the report with additional policy references, correcting/expanding the timeline (including notification timing), and adding/adjusting related incidents and action items.
- Kir representative — KIR stated that all action items had been completed and that there were no further updates.
- CCADB representative — CCADB incident reporting provided guidance for closing the report.
- Kir representative — KIR posted a report closure summary describing the incident, root causes, remediation, and requesting closure after confirming all action items were implemented.
- CCADB representative — CCADB issued a final call for comments and stated the report would be closed around 2025-07-01.