← Microsec Ltd. cases
Bugzilla #2066809
Ca Certificate Compliance
Incident
Self Reported Incident
Revocation Issue
Subscriber Agreement Issue
Microsec insufficient support for unspecified (0) revocation reason
ASSIGNED
Microsec Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsec reported that its revocation tooling does not let customers initiate revocation without choosing a revocation reason, and it also does not automatically default to CRLReason “unspecified (0)” when no reason is provided. The bug cites BR 7.2.2, which requires CA-provided tools to make revocation reasons easy to specify and to default to no revocation reason. The incident was disclosed as a preliminary incident report, and the source of disclosure is stated to be the Apple Root Program. The thread provided does not include any remediation steps or closure; the case was still assigned at the time of the snapshot.
Chronology
- Microsec identified that its revocation tools did not support defaulting to CRLReason unspecified (0) when no revocation reason was provided.
Thread Activity
- Microsec representative — Opened the bug and posted a preliminary incident report describing the revocation-tooling issue and citing BR 7.2.2.
- Microsec representative — Noted that the source of the incident disclosure was the Apple Root Program.
Participants
Microsec representative
External References
Similar Local Cases
SwissSign: Delayed revocation in Bug 2057448
NETLOCK: Failure to file a preliminary incident report within 72 hours (OCSP responder incident, Bug 2051459)
CFCA: Delayed response to CPR-related email related with bug 2049179
IdenTrust: Delayed disclosure of Intermediate CA in CCADB
VISA: Misissuance detected by PKIMetal
Google Trust Services: CPS Missing root program attestation
Actalis: failure to timely update CP/CPS for AgID SubCAs
DigiCert: Delayed availability of OCSP responses