2008972 - Disig: Delayed Full Incident Report

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Jozef Nigut]

Preliminary Incident Report

Summary

• Incident description: Delayed posting of Full Incident Report
• Relevant policies: CCADB Incident Reporting Guidelines v3.1
• Source of incident disclosure: comment in bug https://bugzilla.mozilla.org/show_bug.cgi?id=2007132

Comment 1

[Jozef Nigut]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000008
• Incident description: Delayed submission of Full Incident Report
• Timeline summary:
  • Non-compliance start date: 2026-01-02
  • Non-compliance identified date: 2026-01-06
  • Non-compliance end date: 2026-01-07
• Relevant policies: CCADB Incident Reporting Guidelines v3.1
• Source of incident disclosure: comment in bug https://bugzilla.mozilla.org/show_bug.cgi?id=2007132

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: No, delay did not impact certificate issuance, revocation, or overall CA operations.
• Analysis: No certificate misissuance or ecosystem risk occurred. The delay affected only the timing of the Full Incident Report submission.
• Additional considerations: N/A

Timeline

All times are UTC.

2025-12-19:

• 17:20 new bug 2007132 was created with preliminary incident report

2025-12-24:

• 12:01 update in bug 2007132 was posted

2025-12-30:

• 08:22 update in bug 2007132 was posted

2026-01-05:

• 10:30 update in bug 2007132 was posted

2026-01-07:

• 13:52 The Full Incident Report was actually submitted.

Related Incidents

Bug	Date	Description
2007132	2025-12-19	Certificates with invalid embedded SCT signature.

Root Cause Analysis

Contributing Factor 1: Staffing Issues

• Description: Pre-planned vacations and unavailability of team members during holiday times contributed to the delay.
• Timeline: N/A
• Detection: N/A
• Interaction with other factors: Contributing factor #2

Contributing Factor 2: Holiday Season

• Description: The Christmas and New Year's Eve , moreover 2026-01-06 bank holiday in Slovakia contributed to the delay.
• Timeline: N/A
• Detection: N/A
• Interaction with other factors: Contributing factor #1

Lessons Learned

• What went well: Bug 2007132 was regularly updated.
• What didn’t go well: High number of bank holidays coupled with the pre-planned vacations of team members.
• Where we got lucky: No certificates were affected.
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Submit Full Incident Report	Corrective	Root Cause #1,2	see Bug 2007132	2026-01-07	Complete
Designate at least one team member to be on call during critical holiday periods.	Prevent	Root Cause #1	No more delays in future incidents.	2026-01-13	Complete

Appendix

N/A

Comment 2

[Jozef Nigut]

Report Closure Summary

• Incident description: Delayed posting of Full Incident Report in bug (https://bugzilla.mozilla.org/show_bug.cgi?id=2007132)
• Incident Root Cause(s): The root cause was primarily caused by the holiday season with high number of bank holidays and staff unavailability due to pre-planned vacations.
• Remediation description: the Full Incident Report has been posted 2026-01-07.
  Implemented a holiday coverage plan ensuring that at least one compliance and one technical member are available during holiday or non-standard working periods.
• Commitment summary: Disig remains committed to ensure adherence to the expected reporting timeframes of CCADB and other policies.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 3

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-01-27.