2010525 - CFCA: reporting delayed when handling incident bug #2006333

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Michael]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Steps to reproduce:

Preliminary Incident Report

Summary

• Incident description: During handling Bug #2006333, due to misconception of the CCADB Incident Reporting Guidelines, the full incident report was not submitted within 14 days and delayed for 14 days.
• Relevant policies: CCADB Incident Reporting Guidelines, While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure.
• Source of incident disclosure: Third Party Reported on Bug #2006333

Comment 1

[Michael]

Hi,

We're preparing the Full Incident Report. Will Update it soon.

Comment 2

[Michael]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000272
• Incident description: During handling Bug #2006333, due to misconception of the CCADB Incident Reporting Guidelines, the full incident report was not submitted within 14 days and delayed for 14 days.
• Timeline summary:
  • Non-compliance start date: 2026-01-13 (the delayed full report publish date)
  • Non-compliance identified date: 2026-01-13
  • Non-compliance end date: 2026-01-15 (this bug's filing date)
• Relevant policies: CCADB Incident Reporting Guidelines, "While Full Incident Reports SHOULD be posted as soon as possible, they MUST be posted within 14 days of the incident’s initial disclosure."
• Source of incident disclosure: Third Party Reported in Bug #2006333

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: N/A
• Analysis: N/A
• Additional considerations: N/A

Timeline

All times are in UTC+8 (China Standard Time)

• 2025-12-16: Bug #2006333 Created and Preliminary Incident Report posted
• 2025-12-17 11:42: Certificates from the CPR revoked
• 2025-12-22 15:54: 27 more non-compliant EV certificates identified
• 2025-12-29 09:19: All affected certificates revoked
• 2026-01-05 17:42: CFCA replied the comment and awared of this violation in bug #2009134 and bug #2006333
• 2026-01-13 01:37: Community member comments about delay of Full Incident Report
• 2026-01-13 23:05: Full Incident Report posted
• 2026-01-15 17:40: This bug filed.

Related Incidents

Bug	Date	Description
2008972	2026-01-08	Disig: Delayed Full Incident Report
2004300	2025-12-05	Telia: Delayed submission of preliminary audit incident report
1937210	2024-12-14	DigiCert: Late incident report for bug 1925106
1893546	2024-04-26	e-commerce monitoring gmbh: failure to follow incident report requirements
1890901	2024-04-11	Entrust: Delayed incident report - CPS typographical (text placement) error
2009134	2025-12-16	CFCA: reporting delayed when handling incident bug #2005399 CA Certificate Compliance

Root Cause Analysis

Contributing Factor #1: missing description of full reporting requirements in internal incident handling plan

• Description: Missed full reporting requirements during handling incidents.
• Timeline:
  • 2024-4-20: Incident Handling Guideline was ammended, adding description of timeline requirements, but missed submission of full reporting requirements.
• Detection: After comparing our internal incident handling plan with CCADB text, we found there missed the full reporting requirements.
• Interaction with other factors: Although our compliance team are familiar with CCADB requirements, but will mainly refer to our internal incident handling plan for guidance.
• Root Cause Analysis methodology used: 5-Whys, Document Review

Lessons Learned

• What went well: N/A
• What didn’t go well: N/A
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update internal incident handling plan to fully align with community requiremennts	Prevent	Root Cause #1	internal incident handling plan updated and reviewd	2026-02-14	Ongoing

Appendix

N/A

Comment 3

[Michael]

Hi,

We're still monitoring this bug, if there're no further questions, we'll submit a closure report.

Comment 4

[Michael]

Hi, we've finalized the draft Incident Handling Standards for review. Will update the status later.

Comment 5

[Michael]

Hi,
We completed the Action Items by algning our internal Incident Handling Guidelines with BR and CCADB's Incident Reporting Guidelines. Here're the Updated Action Items:

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update internal incident handling plan to fully align with community requiremennts	Prevent	Root Cause #1/#2	internal incident handling plan updated and reviewd	2026-02-14	completed

Comment 6

[Michael]

Report Closure Summary

• Incident description: During handling Bug #2006333, due to misconception of the CCADB Incident Reporting Guidelines, the full incident report was not submitted within 14 days and delayed for 14 days.
• Incident Root Cause(s): Missing description of full reporting requirements in internal incident handling plan
• Remediation description: Update internal incident handling plan to fully align with community requiremennts
• Commitment summary: We have established and improved internal incident handling guidelines. We will continue to follow up on changes, update internal guidelines in a timely manner, and conduct training on relevant changes.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 7

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-02-18.