SwissSign self-reported incident: TLS certificates backdated beyond the 48-hour limit
SwissSign reported that it identified TLS certificates issued with a notBefore value older than the CA/B Forum Baseline Requirements 48-hour backdating limit. The initial report described one affected certificate and said it was signed with a backdating interval of about 48 hours and 39 minutes. SwissSign later said a third party had informed it about the issue, and its full incident report stated that two TLS DV certificates were affected. One certificate was revoked immediately after issuance during post-linting, while the other expired naturally. SwissSign said issuance was not stopped, but it put a temporary manual process in place to cancel pending orders older than 30 hours, then later released fixed CA software to production and stopped the temporary process. The bug remains assigned, and SwissSign has posted action-item updates including retirement of the DCV method used in the incident.
- SwissSign started productive use of its new CA platform, which later produced certificates with excessive backdating.
- One affected TLS DV certificate was signed with a notBefore date backdated by 17 days and later expired naturally.
- A TLS certificate was signed with a notBefore value about 48 hours and 39 minutes earlier than the signing time, then revoked immediately after post-linting failed.
- SwissSign received a certificate problem report from a third party about the backdating issue.
- SwissSign established a temporary manual process to cancel certificate orders pending for more than 30 hours.
- SwissSign released fixed CA software to production and stopped the temporary manual process.
- SwissSign said it will retire DCV method 3.2.2.4.4 for TLS on or before this date.
- SwissSign AG — SwissSign filed a preliminary incident report describing a TLS certificate backdated beyond the BR 48-hour limit and linked it to an external certificate problem report.
- CCADB representative — Asked whether the certificate was logged in Certificate Transparency and whether it was EV, OV, or DV.
- Sectigo — Commented that crt.sh was having trouble servicing queries and ingesting new CT log entries.
- SwissSign AG — Attached the affected certificate and provided a Censys link for reference.
- SwissSign AG — Posted the full incident report stating that SwissSign had been informed by a third party, that two certificates were affected, and that one was revoked while the other expired naturally.
- SwissSign AG — Posted a scheduled update saying there was no update that week.
- SwissSign AG — Confirmed retirement of DCV method 3.2.2.4.4 for TLS on or before 2027-11-30 and said action item A3 was complete.