Asseco DS / Certum: delayed publication of Full Incident Report for Bug 2055775; report closed after remediation completed
This case concerns Certum’s failure to publish a Full Incident Report within the required 14-day window after it became aware of a third-party-reported issue about incomplete CRL URL disclosures in CCADB. Certum said it initially calculated the deadline from the Preliminary Incident Report publication date, but later confirmed the deadline should have been counted from 2026-07-15 09:19 UTC, when it first received the third-party report and became aware of the issue. The Full Incident Report was published on 2026-07-31, after the applicable deadline of 2026-07-29 09:19 UTC. Certum then updated its internal incident-reporting procedure to define the deadline start point and strengthened its review process for public CA incidents. On 2026-09-07, Certum submitted a closure summary stating that both action items were complete and requested closure, and on 2026-09-08 CCADB issued a final call for comments before closing the report around 2026-09-14. The bug is now resolved.
- Certum became aware of potentially incomplete CRL URL disclosures after receiving a third-party report.
- The applicable 14-day deadline for the Full Incident Report expired.
- Certum submitted the Full Incident Report after the deadline.
- Certum updated its internal incident-reporting procedure to document the reporting deadlines and starting points.
- Certum reported completion of the procedure update and the standardized review process for public CA incidents.
- Certum submitted a closure summary stating that both action items were complete and requested closure.
- CCADB issued a final call for comments and said the report would be closed around 2026-09-14 if there were no further comments.
- Assecods representative — Certum said the Full Incident Report was late because it had counted the 14-day deadline from the Preliminary Incident Report publication date instead of from when it first learned of the issue.
- Assecods representative — Certum filed the Full Incident Report, described the deadline miscalculation, and said it had updated its internal incident-reporting procedure.
- Assecods representative — Certum said it had no further updates and asked for the next update date to be set to 2026-08-31.
- Assecods representative — Certum reported both action items as complete, including the internal procedure update and the standardized review process for public CA incidents.
- Assecods representative — Certum posted a closure summary saying both action items were complete and requesting closure.
- CCADB representative — CCADB posted a final call for comments or questions and said the report would be closed on approximately 2026-09-14.