1826363 - Asseco DS / Certum: Delayed revocation of SSL.COM cross certificate

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Aleksandra Kurosz]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Steps to reproduce:

This is a continuation of the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1815355

We are currently working on an answer and action plan with SSL.COM. We will provide regular updates on this bug.

Comment 1

[Ryan Dickson]

Aleksandra - can you share an incident report for this bug using the format described here - to include specific discussion on root cause analysis and the steps taken to prevent reoccurrence in the future)?

Comment 2

[Aleksandra Kurosz]

We will provide a incident report no later than April,19 2023.

Comment 3

[Aleksandra Kurosz]

1. How your CA first became aware of the problem (e.g. via a problem report submitted to your Problem Reporting Mechanism, a discussion in mozilla.dev.security.policy, a Bugzilla bug, or internal self-audit), and the time and date.

This is a continuation of the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1815355

2. A timeline of the actions your CA took in response. A timeline is a date-and-time-stamped sequence of all relevant events. This may include events before the incident was reported, such as when a particular requirement became applicable, or a document changed, or a bug was introduced, or an audit was done.

07.02.2023 - The bug https://bugzilla.mozilla.org/show_bug.cgi?id=1815355 is created.

07-14.02.2023 - Certum analyzes the problem: checks internal documentation, checks Sub CAs, checks end entity certificates issued from these Sub CAs and other aspects of this case that will be helpful in clarifying the situation. Certum also contacts SSL Corporation in order to confirm the findings.

14.02.2023 - 04.04.2023 - Bug Discussion https://bugzilla.mozilla.org/show_bug.cgi?id=1815355

3. Whether your CA has stopped, or has not yet stopped, issuing certificates with the problem. A statement that you have will be considered a pledge to the community; a statement that you have not requires an explanation.

Certum issues cross-certificates only when they are preceded by a detailed analysis (described below). Until the reported problem is resolved, Certum will not issue any new cross-certificate

4. A summary of the problematic certificates. For each problem: number of certs, and the date the first and last certs with that problem were issued.

A problematic certificate was issued on 11.09.2018.

5. The complete certificate data for the problematic certificates.

https://crt.sh/?sha256=ACF718DF838E640051777D1947F51620E8D804BA186553AE52FC9811B5D34B8B

6. Explanation about how and why the mistakes were made or bugs introduced, and how they avoided detection until now.

Due to the fact that the cross certificate expires soon in September 2023 and the findings from the discussion about the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1815355 we decided not to revoke this cross certificate. The change that introduced the need to audit a cross certificate capable of issuing EV certificates was introduced in 2021, so the problem concerned only one audit statement, because EV certificates have never been and will not be issued from the mentioned cross certificate. Considering the above, during the risk analysis, we decided not to revoke this cross certificate because, taking into account its remaining short validity period and the number of end customers necessary to transfer to a new cross certificate, it would be highly undesirable considering the negligible risk associated with leaving the cross certificate as valid.

7. List of steps your CA is taking to resolve the situation and ensure such issuance will not be repeated in the future, accompanied with a timeline of when your CA expects to accomplish these things.

Certum has stipulated in cross-certification agreements that the partner must act in accordance with CA/B Forum regulations and browser policies, which seemed to be sufficient. As part of corrective actions after this incident, we will change the provision in the contract, we will explicitly state that there are 7 days to revoke the cross certificate, regardless of the reason for the revocation. We will also require partners to inform end customers that if there is any reason for revocation, the time to revoke the certificate will be 7 day.

Comment 4

[Aleksandra Kurosz]

We have no further updates here. Are there any questions?

Comment 5

[Aleksandra Kurosz]

If there are no questions, can this bug be closed?

Comment 6

[Ben Wilson]

Unless there are additional questions or concerns, I intend to close this next Wed. 7-June-2023.