SwissSign delayed revocation after CPR deadline in Bug 2057448
SwissSign reported a delayed revocation incident involving eight TLS OV certificates that had been identified as mis-issued in Bug 2057448. The problem was not that the certificates were left unrevoked indefinitely, but that SwissSign calculated the revocation deadline from confirmation of mis-issuance rather than from receipt of the Certificate Problem Report, as required by BR Section 4.9.5. SwissSign said the last affected certificate was revoked about 12 hours and 30 minutes after the applicable deadline. In its incident report, SwissSign stated that no additional affected certificates were found and that the incident did not affect issuance controls. SwissSign later said it updated and approved its incident response procedure, updated its Bugzilla handling checklist, completed refresher training, and changed its process so even minor changes require review. SwissSign then stated that all action items were complete and requested closure of the bug, and CCADB issued a final call for comments saying the report would be closed around 2026-09-25.
- Certificate Problem Report received for the mis-issuance in Bug 2057448.
- Investigation confirmed the certificate mis-issuance and the impact assessment was completed.
- The revocation deadline under BR Sections 4.9.1.1 and 4.9.5 was reached.
- The last affected certificate was revoked.
- SwissSign recognized that BR Section 4.9.5 had not been considered when determining the revocation deadline.
- SwissSign stated that all action items were complete and requested closure of the bug.
- SwissSign AG — SwissSign filed a full incident report explaining that revocation was completed after the applicable deadline and that the deadline should have been measured from CPR receipt.
- SwissSign AG — SwissSign said it had updated and approved the incident response procedure and completed the checklist update action items.
- SwissSign AG — SwissSign requested that the next update be scheduled for 2026-09-18.
- SwissSign AG — SwissSign said all action items were complete and requested closure of the bug.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-09-25.
- CCADB representative — CCADB repeated the final call for comments and the expected closure date.