Firmaprofesional: Delayed preliminary response under BR 4.9.5 (Bug #2009941)
Firmaprofesional reported a compliance issue related to a Certificate Problem Report (CPR) received on 2026-01-11 in connection with Bugzilla #2009941. The CA stated that, although an automated acknowledgement confirming receipt was sent, it did not provide an explicit preliminary report of findings to the external reporter within 24 hours as required by TLS Baseline Requirements Section 4.9.5. The first explicit human-authored response describing investigation status was sent after the 24-hour deadline. The thread describes this as a communication-timing non-conformity under BR 4.9.5, and notes that the incident concerned external communication obligations only (with total number of certificates affected stated as 0). Firmaprofesional provided a full incident report and later a report closure summary, including completed remediation action items such as mandatory 24-hour CPR response control with owner assignment, automated SLA reminders/escalation, standardized communication templates, and formal deadline tracking for incident-reporting milestones. The bug is marked RESOLVED with resolution FIXED, and CCADB incident-reporting made a final call for comments before closure on approximately 2026-03-30.
- Firmaprofesional received a Certificate Problem Report and sent an automated acknowledgement without preliminary findings.
- The 24-hour BR 4.9.5 preliminary findings deadline elapsed without an explicit preliminary findings report.
- Firmaprofesional sent the first non-automated, human-authored preliminary findings response after the deadline.
- A separate tracking bug (#2016066) was opened with a preliminary incident report describing the BR 4.9.5 timing non-compliance.
- Firmaprofesional submitted a report closure summary stating remediation action items were completed.
- Logalty representative — Submitted a preliminary incident report stating Firmaprofesional did not provide explicit preliminary findings to the CPR reporter within 24 hours under BR 4.9.5.
- Community commenter — Asked where the full incident report was and noted that the timer starts when the CA becomes aware.
- Logalty representative — Posted the full incident report with a timeline and stated the issue was a BR 4.9.5 external communication timing breach.
- Logalty representative — Provided updated action items and stated some planned action items were completed.
- Logalty representative — Confirmed remaining action items due on 2026-03-13 were completed and updated their status.
- Community commenter — Quoted CCADB incident reporting guidance about weekly updates and closure reports.
- Logalty representative — Submitted a report closure summary stating remediation was completed and requested closure.
- CCADB representative — Issued a final call for comments and stated the report would be closed on approximately 2026-03-30.