SDAIA delayed revocation incident for 331 S/MIME certificates after audit coverage gap
This case concerns SDAIA’s delayed revocation of publicly trusted S/MIME subscriber certificates under Government CA 2 after the audit coverage gap reported in Bug 2056942. SDAIA said the affected certificates had to be revoked, but revocation could not be completed within the required 5-day timeframe because immediate revocation could disrupt critical internal government services. SDAIA initially reported 172 certificates still unrevo ked, later updated the remaining count to 45, and then confirmed that all remaining certificates were revoked on 2026-08-16. In its closure summary, SDAIA stated that 331 certificates missed the 5-day revocation deadline and that no affected certificate remains valid. SDAIA also said S/MIME issuance and renewal under the affected hierarchy were suspended on 2026-07-20 and have not resumed. The only remaining open action mentioned in the thread was removal of the S/MIME trust capability from the affected hierarchy, which SDAIA said is tracked under the primary incident, Bug 2056942. The bug is now RESOLVED/FIXED.
- SDAIA identified the incident and suspended S/MIME issuance and renewal under the affected hierarchy.
- The non-compliance period began for delayed revocation of affected S/MIME certificates.
- SDAIA revoked the last remaining affected certificates and ended the non-compliance period.
- SDAIA filed the closure summary stating that 331 certificates missed the 5-day revocation deadline.
- Sdaia representative — SDAIA opened a preliminary incident report saying 172 affected certificates remained unrevo ked and revocation was delayed because immediate revocation could cause operational impact.
- Sdaia representative — SDAIA filed a full incident report stating the delay was due to a risk-based decision to avoid significant operational impact while certificates were being replaced.
- Community commenter — A commenter said the report lacked root cause analysis and that certificates revoked after the deadline were part of the delayed revocation incident.
- Sdaia representative — SDAIA replied that it would update the report and clarified that the incident scope included all certificates revoked after the applicable revocation deadline.
- Sdaia representative — SDAIA confirmed that all remaining affected certificates had been revoked.
- Sdaia representative — SDAIA posted the closure summary stating that 331 certificates missed the 5-day revocation deadline and that the incident was complete.
- CCADB representative — CCADB incident reporting asked for final comments and said the report would be closed around 2026-09-07.