1876771 - SwissSign: modified fields were not saved into certificates and resulted in miss-issuance

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Sandy Balzer]

Attachment: FiledsNotSaved_Certificates.xlsx

Incident Report

Summary

We discovered during a review of our new web shop integration, that during the RAO check, field modification by the RAO in the system of the regulated fields Organization and State were not saved into the certificates.
So this resulted in mis-issued certificates with wrong contents.

Impact

This resulted in a total nr of 11 precerts and 11 TLS certificates (OV) that were mis - issued, since 22nd of December 2023.
For the period of initial internal investigation CA issuance was stopped and then taken up again when it was ensured that certs will be issued correctly.

During testing we discovered that only the OV RAO process is impacted while the EV process isn't. Therefore, we exchanged the OV process with EV process.
This results in a fully compliant RAO process.

Timeline

2024-01-25:

• 11:00 UTC we received an report about this issue from internal employee performing web shop review
• 11:30 UTC Compliance starts Investigation, confirms mis-issuance, starts mis-issuance process and stops RAO Approval of certificates ordered via web shop
• 14:00 UTC Identified Root Cause and identified mitigation
• 11:30 UTC Implementation of mitigation
• 16:00 UTC Information to audit body

2024-01-26:

• 16:20 UTC Posting of this Bugzilla

Root Cause Analysis

The problem only occurs in the new web shop.
Deep analysis showed a bug in the approval process of the RAO for OV certificates.

Lessons Learned

What went well

• Internal review brought the issue up.
• identified root cause quickly

What didn't go well

Where we got lucky

• identified fast mitigation
• that only a small number of certificates was affected and only those ordered by web shop.

Action Items

Action Item	Kind	Due Date	Status
1. Review of web shop	Detect	2024-01-25	Done
2. Change of the RAO check to EV process	Prevent	2024-01-25	Done
3. Revoke mis-issued certificate	Mitigate	2024-01-30	ongoing

Appendix

Details of affected certificates

Comment 1

[Sandy Balzer]

Update: all certificates have been revoked and timeline corrected from typing error (14:00 UTC Identified Root Cause and identified mitigation).

Timeline

2024-01-25:

• 11:00 UTC we received an report about this issue from internal employee performing web shop review
• 11:30 UTC Compliance starts Investigation, confirms mis-issuance, starts mis-issuance process and stops RAO Approval of certificates ordered via web shop
  -14:00 UTC Identified Root Cause and identified mitigation
• 14:30 UTC Implementation of mitigation
• 16:00 UTC Information to audit body

2024-01-26:

• 16:20 UTC Posting of this Bugzilla

2024-01-30

• 15:30 corrected Timeline of Bugzilla from typo
• 16:45 update of Bugzilla

Action Items

Action Item	Kind	Due Date	Status
1. Review of web shop	Detect	2024-01-25	Done
2. Change of the RAO check to EV process	Prevent	2024-01-25	Done
3. Revoke mis-issued certificate	Mitigate	2024-01-30	Done

For this Bugzilla there is no further action planned form our side.
If there are no further questions from the community, we would ask to close this Bugzilla.

Comment 2

[Ben Wilson]

I will leave this open for another week until 7-February-2024 in case there is further discussion.