1887941 - Actalis: revocation delay for certificates issued with invalid RDN Order

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Marco Menonna]

Incident Report

Summary

After receiving an independent report, Actalis first learned of a mis-issuance of 263 EV certificates, as described in https://bugzilla.mozilla.org/show_bug.cgi?id=1883731
Actalis determined to revoke the affected certificates within 5 days after confirmation of the incident while it was supposed to start on the date of receiving the problem report

Impact

The revocation delay impacted 263 certificates

Timeline

All times are UTC.
2024-03-04:
• 14:00 We received an email reporting a potential issue affecting an EV certificate
2024-03-09:
• 14:22 Misissued certificates revocation was expected (as required by BRs 4.9.1.1.)
2024-03-11:
• 09:40 The issue is confirmed as a mis-issuance, and we have decided to revoke all affected certificates within 5 days
• 18:30 We have posted an updated of the preliminary report on Bugzilla
2024-03-15:
• 11:59 All the affected certificates have been revoked
2024-03-18:
• 23:22 We have posted a complete incident report on Bugzilla

Root Cause Analysis

After receiving the problem report, we started investigation in order to verify the accuracy and the relevance of the report.
Although we promptly undertook all the activities related to the issue, ceasing the issuance of new certificates and testing and applying CA software's configurations to fix the problem, our internal process for revocation handling has resulted in an ordinary management process, since no security or usability impacts of the certificates occurred, leading us to delay the revocations due date as defined by the Baseline Requirements, particularly with respect to Section 4.9.1.1.

Lessons Learned

What went well

• The revocation has been completed on time with respect to the defined schedule.

What didn't go well

• The internal process defined for dealing the issue didn't result compliant with the requirements
• The revocation date has been delayed with respect of the BR requirement

Where we got lucky

/

Action Items

| Action Item | Kind | Due Date |
| Incident management processes and procedure revision for mis-issuance handling | prevent | 2024-05-01 |
| Increased internal training for rapid management of revocation date provision | prevent | 2024-05-01 |

Appendix

Details of affected certificates

Affected certficates

Comment 1

[Marco Menonna]

At the moment, we have no further updates on this bug.

Comment 2

[Wayne]

Your action items have a due date up to 2024-05-01, is there an update?

Comment 3

[Marco Menonna]

Here I am with an update of the implementation of the actions outlined in our previous incident report. All the actions have been successfully completed.

By the deadline of May 1, 2024, our incident management team has reinforced and integrated our processes to improve our capacity to handle mis-issuances in order to minimise potential impacts and maintain compliance with CCADB requirements. All the relevant stakehoders have been involved in this activity.

In conjunction with the first action, we have intensified initiatives to ensure that staff awareness, skills and competence in identifying and responding to incidents are enhanced.

If you have any questions or require further details, please feel free to post your queries.

Comment 4

[Ben Wilson]

Are there any reasons why this bug/incident cannot be closed?