1268211 - Revoke duplicate Cloud Operations Digicert certificates

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[:Atoll]

There are three Digicert orders for *.sync.services.mozilla.com:

#00502624 - https://www.digicert.com/enterprise/order-details.php?order_id=00502624
#00477121 - https://www.digicert.com/enterprise/order-details.php?order_id=00477121
#00735728 - https://www.digicert.com/enterprise/order-details.php?order_id=00735728

<ckolos> atoll: The cert still in use for that domain has an exp of Wed, 15 Aug 2018

So, we need to revoke two of these:

#00502624 - expires 01-MAY-2016 - serial 066CDBD51DF9B2D50439F43D8F418621
#00477121 - expires 01-FEB-2017 - serial 0DCE9E97481912202DFF1B93314BA11B
#00735728 - expires 15-AUG-2018 - serial 0FC4776934BDCC1201020E8D90FE1A2C

And request a prorated refund for #00477121 in light of the duplicate issuance. I can handle both the revoke and refund requests with approval from :bobm to proceed, needinfo?'d.

Comment 1

[Bob Micheletto [:bobm]]

(In reply to Richard Soderberg [:atoll] from comment #0)
\
> <ckolos> atoll: The cert still in use for that domain has an exp of Wed, 15
> Aug 2018
> 
> So, we need to revoke two of these:
> 
> #00502624 - expires 01-MAY-2016 - serial 066CDBD51DF9B2D50439F43D8F418621
> #00477121 - expires 01-FEB-2017 - serial 0DCE9E97481912202DFF1B93314BA11B
> #00735728 - expires 15-AUG-2018 - serial 0FC4776934BDCC1201020E8D90FE1A2C

This is correct, we are only using the following:
notAfter=Aug 15 12:00:00 2018 GMT
serial=0FC4776934BDCC1201020E8D90FE1A2C

Please notify us of the scheduling of the revocation.  However unlikely it is that the wrong certificate would be revoked, it would be calamitous.  In such a case, regardless of the remoteness of the possibility, we want to be on hand for a faster recovery.

Comment 2

[:Atoll]

We revoked #00477121 and I've requested a partial refund.

There are others to address:

#00486181, #00502427
*.services.mozilla.com

#00796141, #00844600, #00562848
push.services.mozilla.com

Retitling bug and I'll follow up with specific order/cert details.

Comment 3

[:Atoll]

The remaining certificates were not in the broken state and no further work is required here.