NETLOCK: Failure to Respond to a Certificate Problem Report Within 24 Hours
This case concerns NETLOCK’s failure to begin investigating and provide a preliminary report on a Certificate Problem Report within 24 hours of receipt, as required by CA/Browser Forum TLS Baseline Requirements Section 4.9.5. NETLOCK says the CPR was received at its CCADB-disclosed problem-reporting address on 2026-06-10 23:48 UTC, but mail-handling issues prevented it from reaching the compliance team in time. The company later identified the root cause, reconfigured the compliance mailbox, enabled alerting for messages routed to Junk or quarantine, and verified the fix with test mail. In the latest update, NETLOCK said Action Item #2, customer service training on CPR recognition and escalation, was not yet complete because the final signed confirmations were still being collected. NETLOCK also said the new target date for that work is 2026-08-11, and that it will continue posting updates at least every 7 days until closure. The bug remains ASSIGNED.
- NETLOCK received a Certificate Problem Report at c**********o@netlock.hu.
- The 24-hour CPR response window expired without a preliminary report.
- NETLOCK’s dedicated compliance team became aware of the CPR-response failure and began reviewing mail-system logs.
- NETLOCK completed mail system reconfiguration for c**********o@netlock.hu and reported Action Item 1 complete.
- NETLOCK said Action Item #2 was still incomplete and set a new target date of 2026-08-11.
- Netlock — Filed the full incident report describing the missed 24-hour CPR response and the mail-handling causes.
- Netlock — Reported that both action items remained on track for the committed due date of 2026-08-03.
- Netlock — Reported completion of Action Item 1 and said Action Item 2 remained in progress.
- Netlock — Said there was no additional progress on Action Item 2 and that the v**********s@netlock.hu investigation was ongoing, with a follow-up planned by 2026-08-14.
- Community commenter — Asked whether the Action Item 2 due date remained 2026-08-03 and noted that untimely responses in both incidents were separate incidents.
- Netlock — Said Action Item #2 was not yet complete, the 2026-08-03 date was missed, and the new target date is 2026-08-11.