Steps to reproduce:
We create this ticket in connection with the identification of one certificate issued on June 12, 2022 for which the period validity was 400 days instead of the maximum 398 days allowed.
The ticket for reporting this non-compliance is available at this address https://bugzilla.mozilla.org/show_bug.cgi?id=1774171, and this second ticket was created after internal consolidation of the detailed history of actions carried out.
The certificate involved was issued but not deployed by the certificate manager. https://crt.sh/?id=6926734395&opt=zlint
The non-compliance was identified and escalated on June 14 afternoon, and the following actions have been implemented:
- we checked whether other certificates were concerned, which is not the case.
- We investigated why the automated validity check scripts allowed a duration of 400 days and have identified the case not processed by the scripts.
- The incident has been communicated to all CA and RA teams in order to be more vigilant about this situation and to remind the maximum period of validity.
- Corrections to the verification scripts have been developed, tested and now deployed.
- The certificate, which was not deployed, was revoked on June 15 at 8:37 AM.
Link to CRL : http://crl.certigna.fr/servicesca.crl
Serial Number : 51e3e5d10a6f2e4935e2dd0f79fa0235
- The incident was reported to our supervisory body (ANSSI) and our assessment body (LSTI) on June 15 at 10:00 AM.
We remain at your disposal for any further information.
Automatic checks have been set up to check and correct the validity period of certificates before their issuance. But our verification scripts did not cover a special case related to a certificate renewal where a Regristration Operator could manually increase the lifetime of the certificate for commercial purposes (which rarely happens). The operator was aware of the 397-day limitation of our certificates but thought that the control would automatically rectify the duration as for other situations, which was not the case for this type of exceptional situation.