Microsec revocation-tooling non-compliance with default unspecified(0) reason; draft CP/CPS published and final policy still pending
Microsec reported a compliance issue in its revocation tooling: customers could not request revocation without specifying a reason, and the system did not default to CRLReason "unspecified (0)" when no reason was provided. The case is about a procedural failure to meet BR 7.2.2’s requirement for CA-provided revocation tools, not about certificate misissuance or delayed revocation. Microsec said the non-compliance began on 2023-07-15 and ended on 2026-08-31, and that no certificates had to be revoked because the problem affected revocation-reason handling rather than the certificates themselves. In response, Microsec completed issuance of a dedicated TLS CP/CPS on 2026-09-16, published the draft regulations on 2026-10-08, and said the final policy documents are still pending. The bug remains assigned to Microsec and is still open.
- The non-compliance period began for revocation requests that did not receive the required default unspecified(0) handling.
- The issue was identified after an Apple comment in CCADB on Microsec’s root inclusion request 00003342.
- Microsec said the non-compliance ended.
- Microsec completed issuance of a dedicated TLS CP/CPS and published an interim v3.20.1 policy release.
- Microsec published the draft regulations and marked action item #2 complete, while final policy documents remained ongoing.
- Microsec representative — Opened a preliminary incident report describing the revocation-tooling issue and citing BR 7.2.2.
- Microsec representative — Stated that the source of the incident disclosure was the Apple Root Program.
- Microsec representative — Posted a full incident report with the non-compliance dates, impact, and a note that Microsec responded in CCADB and would review its CP/CPS and processes.
- Microsec representative — Posted a status report saying the dedicated CP/CPS issuance task was complete, while draft and final policy-document tasks were still ongoing.
- Microsec representative — Posted a status report saying draft CP/CPS work was still in progress and final policy documents still depended on that work.
- Microsec representative — Posted a status report saying new requirements had delayed the draft policy deadline by one week and adjusted the final policy deadline.
- Microsec representative — Posted a status report saying the draft regulations were officially published and action item #2 was completed.
- Microsec representative — Posted a status report saying no user comments were received on the published drafts and the planned effective date had not changed.