NAVER Cloud Trust Services: Failure to respond to CPR within 24 hours
The case concerns NAVER Cloud Trust Services’ handling of a Certificate Problem Report (CPR) submitted to its d**********a@navercorp.com mailbox. The CPR related to an issue where the caIssuers URI returned a PEM-encoded certificate instead of DER. The CA did not provide an acknowledgment or preliminary response within the 24-hour timeframe required by Baseline Requirements (BR) Section 4.9.5; the CA’s first acknowledgment was posted publicly in Bugzilla after the 24-hour window. NAVER Cloud Trust Services confirmed receipt, investigated, and submitted a Preliminary Incident Report in Bugzilla. In its Full Incident Report and closure summary, the CA stated the non-compliance was limited to delayed acknowledgement of the CPR (and did not involve certificate issuance or revocation). The CA reported remediation including automated mobile/web alerts and a mandatory twice-daily review process for the reporting mailbox covering weekends and public holidays, and requested closure. The bug is marked RESOLVED with resolution FIXED.
- A Certificate Problem Report was submitted to NAVER Cloud Trust Services’ d**********a@navercorp.com mailbox.
- NAVER Cloud Trust Services acknowledged the CPR in Bugzilla and initiated investigation after the 24-hour window.
- NAVER Cloud Trust Services submitted the Full Incident Report in Bugzilla.
- NAVER Cloud Trust Services submitted the Report Closure Summary describing remediation and requesting closure.
- Community commenter — Reported that a message sent to d**********a@navercorp.com after seeing Bug 2004492 received no delivery failure and asked NAVER to look into an affected certificate’s caIssuers URI returning a PEM-encoded certificate.
- Navercorp representative — Confirmed receipt of the report and said a Preliminary Incident Report would follow shortly.
- Navercorp representative — Posted a Preliminary Incident Report stating no acknowledgment or preliminary response was provided within 24 hours as required by BR 4.9.5.
- Navercorp representative — Posted a Full Incident Report with a timeline, stating the first acknowledgment was posted publicly after the 24-hour window and describing the incident as delayed CPR acknowledgement.
- CCADB representative — Noted the report had gone stale and referenced filing a Closure Report if ready for closure.
- Navercorp representative — Submitted a Report Closure Summary describing root cause (manual monitoring without automated alerting/formalized review for weekends/holidays) and remediation (automated alerts and twice-daily mailbox review) and requested closure.
- CCADB representative — Issued a final call for comments and said the incident report would be closed approximately 2026-01-14.