SwissSign delayed revocation incident closed after remediation and final mass revocation testing
SwissSign self-reported a delayed revocation incident involving 454,436 S/MIME MV certificates that had to be revoked within 120 hours after Bugzilla 2033000. The company said the revocation missed the BR timeframe because of LDAP workflow issues, a batch-revocation software bug, and a database buffer that was too small. SwissSign reported that all affected certificates were revoked on 2026-04-22 17:32 UTC and later posted a full incident report and closure summary. It then completed remediation work, including runbook updates, software/configuration fixes, and a redesigned mass revocation test procedure covering different certificate states, volume, and load. In the final update, SwissSign said the technical problems were remediated, all action items were completed, and it requested closure; CCADB issued a final call for comments and said the bug would be closed around 2026-10-12.
- SwissSign completed revocation of the affected S/MIME MV certificates after missing the intended revocation timeframe.
- SwissSign posted the full incident report describing the delayed revocation and its contributing factors.
- SwissSign reported that updated runbooks had been reviewed by auditors and were now used in production.
- SwissSign completed final mass revocation tests for S/MIME and TLS certificate populations.
- SwissSign submitted a closure summary and requested that the incident report be closed.
- SwissSign AG — Posted a preliminary self-reported incident report saying performance issues prevented timely revocation and that all affected certificates had been revoked.
- SwissSign AG — Corrected the revocation completion time and said the next update would be the full incident report.
- SwissSign AG — Posted the full incident report with the revocation count, timeline, contributing factors, and remediation action items.
- Community commenter — Asked whether SwissSign had validated production-scale mass revocation capability and requested clarification on readiness and future exercises.
- SwissSign AG — Said the action items were still open, explained the testing gaps, and updated the remediation plan with additional action items.
- SwissSign AG — Reported that the updated runbooks were reviewed by auditors and are now used in production, with action items #1 and #2 marked done.
- SwissSign AG — Described the final mass revocation test setup, results, and said the numbers gave good confidence for revoking the full certificate population within the required time.
- SwissSign AG — Marked all remediation action items done and said SwissSign would continue observing the bug for feedback and prepare the closure report.
- SwissSign AG — Posted the closure summary, said the technical problems were remediated, and requested closure.
- CCADB representative — Issued a final call for comments and said the bug would be closed around 2026-10-12.