SwissSign: Delayed revocation related to Bugzilla 2033000
This case documents a delayed revocation incident affecting SwissSign S/MIME MV certificates. SwissSign self-reported that due to performance issues, not all impacted certificates from the related Bugzilla 2033000 were revoked within the required timeframe. SwissSign stated that all affected certificates were revoked by 2026-04-22 17:32 UTC (with a time zone difference noted versus the preliminary report). The full incident report says SwissSign had to revoke 454,436 certificates within 120 hours, but three unexpected contributing factors prevented revocation from completing within the BR requirement. SwissSign attributed the delay to issues including LDAP updates during S/MIME certificate issuance/revocation (caused by storage exhaustion) and batch revocation failures where a single already-revoked certificate could cause a batch to fail. SwissSign provided remediation action items, including updating mass revocation runbooks (LDAP reconfiguration and increasing WAL size), improving batch-revocation software, and conducting a large-scale mass revocation test with results to be published in this Bugzilla. As of 2026-05-19, SwissSign reported that the updated runbooks had been reviewed by auditors and are now used in production, with remaining action items still open.
- SwissSign completed revocation of all affected S/MIME MV certificates after a delayed mass revocation process.
- SwissSign posted the full incident report describing the delayed revocation and contributing factors.
- SwissSign reported auditor review and production use of updated mass revocation runbooks.
- SwissSign AG — Posted a preliminary incident report stating that performance issues prevented timely revocation and that all affected certificates were revoked as of 2026-04-22 18:32, citing TLS BR chapter 4.9.1.1 and self-reported disclosure.
- SwissSign AG — Corrected the revocation completion time to 2026-04-22 17:32 UTC and said the next update would be the full incident report.
- SwissSign AG — Posted the full incident report for Bug 2033000-related delayed revocation, including the need to revoke 454,436 certificates within 120 hours, the contributing factors, the timeline, and remediation action items.
- Community commenter — Questioned whether SwissSign demonstrated validated production-scale mass revocation capability and requested clarifications about modeling, readiness, and future exercises.
- SwissSign AG — Responded to the questions, stated that action items were not yet closed, and updated the action items including adding a new action item for a mass revocation test plan and publication of results.
- SwissSign AG — Indicated no update for the week.
- SwissSign AG — Reported that updated runbooks were reviewed by auditors and are now used in production, marking action items #1 and #2 as done and leaving others open.