← Certigna cases
Bugzilla #2080698
Ca Certificate Compliance
Incident
Self Reported Incident
Ccadb Disclosure Issue
Remediation Tracking
Certigna: Failure to report action-item completion within the required 3-day window
ASSIGNED
Certigna
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Certigna reported that it completed an action item from Bug 2076795 by the due date, but did not update the bug within three days of completion as required by the CCADB Incident Reporting Guidelines v3.2. The case was opened by Certigna itself, and the thread states that the non-compliance was first identified after a third party commented on the bug. Certigna said there was no certificate impact and no issuance was stopped in response. The full incident report says the non-compliance ran from 2026-10-05 to 2026-10-19. Certigna also said it updated its corrective-action procedures and raised staff awareness to address the issue. The bug remains assigned to Certigna.
Chronology
- An action item in Bug 2076795 reached its due date and was completed by Certigna.
- The required 3-day deadline to update the ticket after action completion began.
- Certigna updated the bug to confirm that all actions were implemented.
- Certigna updated its corrective-action procedures and raised staff awareness about the 3-day update deadline.
Thread Activity
- Dhimyotis representative — Certigna filed a preliminary incident report saying it met the action item due date but failed to report completion within three days as required by CCADB Incident Reporting Guidelines.
- Dhimyotis representative — Certigna filed the full incident report, described the timeline and root cause, and listed corrective actions as complete.
Participants
Dhimyotis representative
External References
Similar Local Cases
Sectigo: Failure to announce completion of action item within prescribed time period
Telekom Security: Failure in automatic issuance of CRLs
Actalis: Root CA CRL not published within 24 hours after recording revocations
NETLOCK: Failure to file a preliminary incident report within 72 hours (OCSP responder incident, Bug 2051459)
Actalis: failure to timely update CP/CPS for AgID SubCAs
FNMT: Delay in incident disclosure reporting for Bug 2049012
PKIoverheid: Delayed Disclosure of Incident Report Beyond the Required 72-Hour Timeframe
IZENPE: revocation reason code not included in CRL issued by Root