2004704 - Certigna: Failure to respond to CPR within 24 hours

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Dexter Döpping]

Steps to reproduce:

Around 2025-12-06 01:21 I submitted a problem report to Certigna using their web form at https://certigna.com/contactez-nous/

I'm not French so I used Firefox's translation feature to translate the page to Dutch. The category options weren't translated. I selected the option "Signaler une non-conformité" after verifying its translation in Google translate.

I entered my personal gmail address in the web form.

I didn't save the exact text in my problem report, but it should've been similar to this:

caIssuers http link in certificate returns PEM encoded certificate

Dear CERTIGNA,

After seeing this BugZilla report: https://bugzilla.mozilla.org/show_bug.cgi?id=2004492

I looked through other intermediate certificates to see if they have the same issue.

It appears that the following certificate is affected:

C=FR,O=DHIMYOTIS,OU=0002 48146308100036,CN=FR03<br>
080e7e36b3c7fa96ecc67db7f4d41cece1d194401af196a4a47b79bdc4970574

It includes an issuer ca link to http://autorite.certigna.fr/certignarootca.crt, which at the moment returns a PEM encoded certificate.

According to RFC 5280 4.2.2.1 the certificate may not be PEM encoded:

> Where the information is available via HTTP or FTP, accessLocation<br>
> MUST be a uniformResourceIdentifier and the URI MUST point to either<br>
> a single DER encoded certificate as specified in [RFC2585] or a<br>
> collection of certificates in a BER or DER encoded "certs-only" CMS<br>
> message as specified in [RFC2797].

Could you please look into this?

Thank you, Kind regards,
Dexter

Actual results:

The website showed an automatic success message after I submitted the form.

Expected results:

I should've received some kind of communication from Certigna that tells me they received my report and they confirmed or at least are looking into the reported issue.

I don't think the automated success screen on the website satisfies section 4.9.5 of the BRs.

Comment 1

[Josselin Allemandou]

Preliminary Incident Report

Summary

• Incident description: Certigna received a message on Saturday, 6 December 205 at 2:21 a.m. (UTC) notifying of a potential non-compliance issue related to a CA not issuing TLS or S/MIME certificates. An acknowledgement of receipt was sent via the website and a second email relating to the investigation was sent to the requester on Monday at 4:26 p.m. (UTC).

Impact

• Total number of certificates: 0 SSL/TLS or S/MIME certificates

Comment 2

[Dexter Döpping]

An acknowledgement of receipt was sent via the website and a second email relating to the investigation was sent to the requester on Monday at 4:26 p.m. (UTC).

I've not received any emails yet. To be fair, I don't really need one at this point, but I'm curious of what's going wrong here. It's of course possible I typo'd my email in the web form. Are you using dexter[dot]c[dot]dopping[at]gmail[dot]com?

Comment 3

[Dexter Döpping]

I've received a new email now from Certigna at 2025-12-08T19:13 UTC

Comment 4

[Josselin Allemandou]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000011

• Incident description: The preliminary report was not provided within 24 hours to the third party who filed the Certificate Problem Report that we linked to this bug “Certigna : AIA CA issuer field pointing to PEM encoded cert”.

• Timeline summary:

  • Non-compliance start date: 2025-12-06
  • Non-compliance identified date: 2025-12-06
  • Non-compliance end date: 2025-12-08

• Relevant policies: TLS Baseline Requirements v2.1.9 Section “4.9.5 Time within which CA must process the revocation request”

• Source of incident disclosure: Third Party Reported

Impact

• Total number of certificates: N/A (0 TLS, S/MIME or Code signing certificates)
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: The report only concerned a subordinate certificate (FR03 crt.sh | 163641632), which included a URL that explicitly pointed to a certificate in PEM format.
• Was issuance stopped in response to this incident, and why or why not?: Yes. It wasn't necessary, but we avoided issuing certificates with this CA during the correction period as a precaution.
• Analysis: N/A
• Additional considerations: N/A

Timeline

All times are UTC.

2025-12-06:

• 01:21: Message posted by a third party on our website via the contact service mentioning a potential non-compliance of the AIA field of one CA certificate. A message confirming receipt of the request was displayed following submission.

2025-12-07:

• 10:13: Message qualified by customer service and not concluding that it was necessary to revoke the CA certificate or the associated end-entity certificates. However, the department failed to respond to the applicant within 24 hours, considering this CA certificate to be outside the scope of the CAB Forum requirements (not linked to TLS, SMIME or code signing certificates), and having identified no need to initiate a revocation.

2025-12-08:

• 09:30: Notification to employees involved in issuing certificates.
• 09:30: Stop issuing certificates under the impacted CA pending corrections.
• 10:00: Identification of all CA certificates impacted by the potential non-compliance.
• 14:16: This bug was opened by the third party who submitted the CPR.
• 16:37: Response to the ticket with the provision of a preliminary report.
• 19:13: New message sent by email to the applicant by the compliance team to reconfirm that the ticket has been considered and our technical teams are working on it.

2025-12-09:

• 10:00: Raising awareness among teams about this non-compliance and the one targeted by the associated bug “Certigna : AIA CA issuer field pointing to PEM encoded cert”.

Related Incidents

Bug	Date	Description
Bug 2005762	2025-12-12	Failure to respond to CPR within 24 hours
Bug 2004698	2025-12-08	Failure to respond to CPR within 24 hours
Bug 1985466	2025-08-27	Failed to respond a Certificate Problem Report within 24 hours and create a preliminary report in 72 hours
Bug 1967929	2025-05-22	Failed to respond a Certificate Problem Report within 24 hours
Bug 1905509	2025-06-29	CPR was not responded to in 24 hours
Bug 1970727	2025-06-05	Failure to respond to a Problem Report within 24 hours
Bug 1959733	2025-04-10	Failed to respond a Certificate Problem Report within 24 hours which violates Section 4.9.5 of the TLS BRs
Bug 1927675	2024-10-28	CPR was not responded to within 24 hours
Bug 1902868	2024-06-15	CPR was not responded to in 24 hours
Bug 1888881	2024-04-01	Failure to respond to a CPR in a complete and/or timely manner
Bug 1886998	2024-03-22	Late response to a CPR
Bug 1886722	2024-03-21	Delayed response to CPR
Bug 1886626	2024-03-20	Delayed response to CPR
Bug 1885754	2024-03-16	CPR was not responded to in 24 hours

Root Cause Analysis

Contributing Factor #1: Raise awareness among customer service teams

• Description: CPRs are generally received and processed directly by the compliance team. However, requests are very rare at weekends, and the customer relations team takes over to ensure that certificates are revoked if necessary. The customer service team was not sufficiently aware of the fact that a response to a third-party requester had to be provided within 24 hours of the request, even if the certificate did not need to be revoked and was not related to TLS, SMIME or Code Signing certificates. Customer service waited for the compliance team to return on Monday to determine whether that team wished to provide a specific response to this request, but by then it was already too late.
• Timeline:
  2025-12-06 01:21: Message posted by a third party on our website
  2025-12-08 14:16: This bug was opened by the third party who submitted the CPR.
  2025-12-08 16:37: Response to the ticket with the provision of a preliminary report.
  2025-12-08 19:13: New message sent by email to the applicant by the compliance team.
  2025-12-09 10:00: Raising awareness among teams about this non-compliance.
• Detection: Bug opened by the third party who submitted the CPR.
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well: This report did not result in certificate revocation, and no TLS, S/MIME, or code signing certificates were directly affected by this ticket, which targeted the subordinate CA “FR03”. The assessment and correction actions were initiated promptly, although the return email was not sent within 24 hours.
• What didn’t go well:
  The return email to the third party who reported the issue was not sent within 24 hours by customer service. Furthermore, although browsers offer this feature, our website does not explicitly provide any option for completing the contact form in English.
• Where we got lucky: N/A
• Additional: N/A
   

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Ongoing
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-01-30	Ongoing

Appendix

The following subordinate CA certificates are impacted:

• crt.sh | 163641632: FR03

Comment 5

[Josselin Allemandou]

Updated Action Items

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Complete
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-01-30	Ongoing

Comment 6

[Josselin Allemandou]

Updated Action Items

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Complete
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-01-30	Ongoing

Comment 7

[Josselin Allemandou]

Updated Action Items

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Complete
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-01-30	Ongoing

Can an Operator set the “Next update” date in the “Whiteboard” field to the date of completion of the last action ongoing (30 January 2026), please? Thank you.

Comment 8

[Josselin Allemandou]

Updated Action Items

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Complete
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-02-28	Ongoing

Can an administrator set the “Next update” date in the “Whiteboard” field to the date of completion of the last action (28 february 2026), please? Thank you.

Comment 9

[Aaron Gable]

Can you give more detail on why an extension of a month is necessary for completing an action item that does not involve any breaking changes? What roadblocks were encountered that prevented completing this plan on the originally-committed timeline? Why was extending the remediation timeline the best solution to those roadblocks?

Comment 10

[Josselin Allemandou]

This is an update to our website, which was added to a batch of updates, some of which were not finalised in January, resulting in the postponement of the entire batch. The rollout is expected to take place before the end of February.

Comment 11

[Josselin Allemandou]

Updated Action Items

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among customer service contributors about guidelines for responding to requests	Prevent	Root Cause # 1	Should limit the occurrence of this type of incident	2025-12-09	Complete
Update of customer service procedures with updated response guidelines and associated deadlines.	Mitigate	Root Cause # 1	Clearer guidelines for customer service	2026-12-19	Complete
Update of the website's contact page with the addition of a feature allowing access to the form in English.	Mitigate	Root Cause # 1	Contact form available in English	2026-02-28	Complete

Comment 12

[Josselin Allemandou]

Report Closure Summary

• Incident description: The preliminary report was not provide within 24 hours to the third party who filed the Certificate Problem Report that we linked to this bug “Certigna : AIA CA issuer field pointing to PEM encoded cert”.
• Incident Root Cause(s): CPRs are generally received and processed directly by the compliance team. However, requests are very rare at weekends, and the customer relations team takes over to ensure that certificates are revoked if necessary. The customer service team was not sufficiently aware of the fact that a response to a third-party requester had to be provided within 24 hours of the request, even if the certificate did not need to be revoked and was not related to TLS, SMIME or Code Signing certificates. Customer service waited for the compliance team to return on Monday to determine whether that team wished to provide a specific response to this request, but by then it was already too late.
• Remediation description: Raising awareness among customer service contributors about guidelines for responding to requests, update of customer service procedures with updated response guidelines and associated deadlines, and update of the website's contact page with the addition of a feature allowing access to the form in English.
• Commitment summary: Improvement of practices and guidelines regarding the processing of requests received outside business hours.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 13

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-02-27.