IZENPE: Failed to respond to a Certificate Problem Report within 24 hours and create a preliminary report within 72 hours
This case concerns Izenpe S.A.’s delayed response to a Certificate Problem Report notification related to bug 1976256. Izenpe stated that it failed to respond in a timely manner in two moments: it did not create a Certificate Problem Report within 24 hours and did not file a preliminary or full incident report within 72 hours. The incident disclosure cited CCADB v3.1 “When are reports expected?” and CABForum 4.9.5. Izenpe reported that the non-compliance period started on 2025-07-03 and ended on 2025-07-08, when a preliminary report was filed; it also stated that a full report was filed on 2025-07-16. Izenpe attributed the delay to both points of contact being unavailable and to remaining staff lacking knowledge to answer and file the incident report. In remediation, Izenpe said it updated CCADB to include all staff related to SSL certificates issuance, ensured one person would always be on guard, and shared incident-response instructions with technical staff, including an exam/test requirement. The bug is marked RESOLVED with resolution FIXED, and Izenpe requested closure after completing the action items described in the closure summary.
- Izenpe’s response window began after receiving the second email, leading to non-compliance with the expected reporting timelines.
- Izenpe filed a preliminary incident report after the delayed reporting period.
- Izenpe filed the full incident report.
- Izenpe provided a report closure summary stating remediation actions were completed and requested closure.
- Izenpe S.A. — Opened the full incident report describing that Izenpe failed to create a Certificate Problem Report within 24 hours and did not file a preliminary/full report within 72 hours, referencing bug 1976256 and the relevant CCADB/CABForum timing requirements.
- Izenpe S.A. — Reported that CCADB was updated to include all member staff related to SSL certificates issuance and that one person would always be on guard; noted CCADB case 00002684 was closed.
- Izenpe S.A. — Shared incident disclosure instructions with technical staff and stated they would be uploaded to an internal application with an exam requirement.
- CCADB representative — Asked Izenpe to provide an update or a closure report because the incident report had gone stale.
- Izenpe S.A. — Said the remaining item was for staff to pass the exam and provide evidence, and that this would be finished that week.
- CCADB representative — Issued another stale-report reminder requesting an update or closure report.
- Izenpe S.A. — Reported that the final action (a brief test to ensure understanding) was completed the previous week.
- Izenpe S.A. — Provided the report closure summary stating the root causes (POCs unavailable; remaining staff lacked knowledge) and remediation (staff inclusion in CCADB; incident-response guideline and annual test commitment), and requested closure.
- CCADB representative — Made a final call for comments and stated the report would be closed approximately 2025-11-17.