← SwissSign AG cases
Bugzilla #1995252
Incident
SwissSign: Attribute Change process did not revoke single-domain certificates
RESOLVED
FIXED
SwissSign AG
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SwissSign AG reported an incident where their system failed to revoke single-domain OV TLS certificates during an attribute change process. This issue was triggered by customer feedback on 2025-10-07, leading to an investigation that confirmed the failure to send revocation emails and perform necessary revocations. The CA suspended the attribute change procedure and initiated a root cause analysis, which revealed that an update to their pricing model caused links to be incorrectly overwritten. The incident was resolved with corrective actions implemented by 2025-10-21, and a final incident report was submitted on 2025-12-04.
Chronology
- Attribute change initiated, leading to customer inquiries.
- Compliance team escalated the issue after confirming the failure.
- Non-compliance ended after corrective actions were implemented.
- Final incident report submitted and closure requested.
Thread Activity
- SwissSign AG — Preliminary incident report submitted detailing the issue.
- SwissSign AG — Full incident report provided with detailed analysis and corrective actions.
- SwissSign AG — Closure summary report submitted, detailing remediation and commitment to prevent future issues.
Participants
SwissSign AG
CCADB representative
External References
Similar Local Cases
SwissSign: recommendation on BIA/BCP review
SwissSign: recommendation on BIA/BCP test coverage
SwissSign: recommendation on firewall review
SwissSign: recommendation on log review process
SwissSign: Certificate Profile error for S/MIME MV
SwissSign: recommendation on document release dual control
Certigna: Multiple Reserved Certificate Policy Identifiers in CA certificates
NETLOCK: did not file a preliminary incident report or respond to a third-party report within the 72-hour timeframe