SwissSign delayed revocation after CPR deadline in Bug 2057448
SwissSign reported a delayed revocation incident tied to Bug 2057448, where eight TLS OV certificates had been identified for revocation after a certificate mis-issuance. The company said it initially measured the revocation deadline from confirmation of the mis-issuance, but later recognized that BR Section 4.9.5 required the timeline to be measured from receipt of the Certificate Problem Report. SwissSign stated that the last affected certificate was revoked about 12 hours and 30 minutes after the applicable deadline. The report says the issue was discovered during later discussion of the earlier incident, and that no additional affected certificates were identified. The bug remains assigned, with SwissSign describing the root cause as incomplete consideration of the relevant Baseline Requirements in its process review.
- Certificate Problem Report received for the mis-issuance in Bug 2057448.
- Investigation confirmed the certificate mis-issuance and the impact assessment was completed.
- The revocation deadline under BR Sections 4.9.1.1 and 4.9.5 was reached.
- The last affected certificate was revoked.
- SwissSign recognized that BR Section 4.9.5 had not been considered when determining the revocation deadline.
- SwissSign AG — SwissSign filed a full incident report explaining that revocation was completed after the applicable deadline and that the deadline should have been measured from CPR receipt.