Microsoft PKI Services: Failure to disclose incident within 72 hours (expired sample site certificates)
Microsoft PKI Services reported that it became aware of expired “valid” and “revoked” certificate samples on its public Sample Sites for two Root Certificates, which it stated was out of compliance with Section 2.2 of the Baseline Requirements. The issue was remediated on December 29, 2025, but Microsoft said it did not open the related Bugzilla within the CCADB-required 72-hour disclosure window. Microsoft attributed the delayed disclosure to internal approval processes extending beyond the required reporting timeframe, and to escalation guidance not clearly documenting how to proceed when designated approvers were unavailable. As a result, Microsoft opened this bug (2009541) on January 9, 2026 to disclose and track the delayed incident disclosure, after Bug 2008847 had been opened on January 6, 2026 for the original sample site certificate expiration. Microsoft reported that the incident relates solely to the timing of incident disclosure and does not involve certificate mis-issuance, compromise, or impact to relying parties. The bug is marked RESOLVED with resolution FIXED, and Microsoft stated it updated its disclosure process to clarify expectations for timely Bugzilla disclosures, including when primary approvers are unavailable.
- Microsoft remediated expired “valid” and “revoked” sample site certificates posted for two Root Certificates.
- Microsoft opened Bug 2008847 to address and remediate the sample site certificate expiration issue.
- Microsoft opened this bug (2009541) to disclose and track the delayed incident disclosure.
- Bug status last changed to RESOLVED.
- Microsoft Corporation — Opened a preliminary incident report stating Microsoft became aware of expired sample site certificate samples on 2025-12-29 and that a Bugzilla was opened on 2026-01-06, noting the delay as non-compliance with reporting obligations.
- Microsoft Corporation — Provided a full incident report, stating the reporting delay was due to internal approval processes extending beyond the required timeframe and that the issue was reported once approval to publish was obtained.
- Microsoft Corporation — Reported completion of action item #1 to update the reporting process to clarify escalation chain and establish backups for when approvers are out of office.
- Microsoft Corporation — Submitted a report closure summary stating the expired sample certificates were remediated on 2025-12-29, the delayed disclosure was tracked in this bug, and remediation included updating the disclosure process to clarify timely Bugzilla disclosures.
- CCADB representative — Posted a final call for comments or questions and indicated the incident report would be closed around 2026-02-10.
- Microsoft Corporation — Noted the closure report had been submitted and asked to close if no other comments were provided.