2009541 - Microsoft PKI Services: Failure to report within 72 hrs - Sample Site Certs Expired

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Microsoft PKI Services]

Preliminary Incident Report

Summary

• Incident description:
  On 2025 12 29 at ~9:15 AM PST, Microsoft PKI Services became aware of expired “valid” and “revoked” certificate samples on our Sample Sites for two Root Certificates, which is out of compliance with Section 2.2 of the Baseline Requirements. Bug 2008847 was opened on 2026-01-06 to address and remediate this issue. CCADB policy mandates that we must open a Bugzilla within 72 hours of becoming aware of such an issue. This delay represents a non-compliance event with our reporting obligations.

• Relevant policies:

  • CCADB Policy Section 6.1 – stating we must follow CCADB IRG
  • CCADB Incident Reporting Guidelines

• Source of incident disclosure:
  Relying Party