Open Bug 2066809 Opened 2 months ago Updated 23 hours ago

Microsec: Insufficent support for "unspecified (0)" revocation reason

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: szoke.sandor, Assigned: szoke.sandor)

Details

(Whiteboard: [ca-compliance] [crl-failure] [policy-failure])

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36

Preliminary Incident Report

Summary

  • Incident description:

    Microsec currently does not allow customers to initiate a revocation without specifying a revocation reason, nor does it automatically set the revocation reason to “unspecified (0)” if no revocation reason is provided anyhow.

  • Relevant policies:

    Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates,

    Version 2.2.9, 6-Aug-2026

    7.2.2 CRL and CRL entry extensions

    "Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason “unspecified (0)” which results in no reasonCode extension being provided in the CRL)."

  • Source of incident disclosure:

    Apple Root Program

Assignee: nobody → szoke.sandor
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [crl-failure] [policy-failure]
Type: enhancement → task

Full Incident Report

Summary

  • CA Owner CCADB unique ID:

    A000038

  • Incident description:

    Microsec currently does not allow customers to initiate a revocation without specifying a revocation reason, nor does it automatically set the revocation reason to “unspecified (0)” if no revocation reason is provided anyhow.

  • Timeline summary:

    • Non-compliance start date: 2023-07-15

    • Non-compliance identified date: 2026-08-25

    • Non-compliance end date: 2026-08-31

  • Relevant policies:

    Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates,

    Version 2.2.9, 6-Aug-2026

    7.2.2 CRL and CRL entry extensions

    "Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason “unspecified (0)” which results in no reasonCode extension being provided in the CRL)."

  • Source of incident disclosure:

    Third Party Reported

Impact

  • Total number of certificates:

    The number of our valid website authentication certificates is currently 2.641

  • Total number of "remaining valid" certificates:

    As a result of the incident, no certificates had to be revoked, since the error did not affect the certificates themselves, but rather the ability to specify the revocation reason.

  • Affected certificate types:

    DV & OV & EV

    The problem affected each website authentication certificates, regardless of type.

  • Incident heuristic:

    The issue affected all website authentication certificates that were scheduled to be revoked between 2023-07-15, and 2026-08-31, without a revocation reason being provided.

  • Was issuance stopped in response to this incident, and why or why not?:

    Issuance was not stopped because the error did not affect the issuance process or the valid certificates.

  • Analysis:

  • Additional considerations:

Timeline

2022-04-28

  • Previously, Microsec allowed the selection of the unspecified(0) revocation reason, but in such cases, it entered a value of “0” into the CRL
  • In response to changes in Mozilla's requirements, Microsec temporarily discontinued the use of the “unspecified(0)” revocation reason and required that other revocation reasons be specified in all cases.

2022-05-05

  • a jira epic was opened to start the developments to fully conform to the requirements
  • a very detailed list was created listing all the necessary developments and changes in our processes
  • the tasks were prioritized
    • high priority tasks to solve the incorrect CRL entries by temporarily omitting the unspecified(0) revocation reason
      • jira tasks opened to selve the high priority issues
      • development was finished
      • changes were release3d in the production system
    • middle priority tasks were created to make the necessary developments for full comliance, but the development was postponed
      • jira tasks were opened only for some of the tasks, others were only on the description of the epic as a plain text
      • the opened jira tasks were solved
    • after closing all open task the jira epic was closed by mistake, without solving all the necessary issues. As a result of this, the unspecified(0) revocation reson was introduced only for the revocation requests originated by the CA

2023-03-12

  • the new revocation requirement became part of the CABF BR version 1.8.7
  • the CABF BR says: "New CRL Entries must have a Revocation Reason Code" and based on this requirement the unspecified(0) revocation code was not introduced for requests originated by clients
  • the CABF BR also says, that "unless the CRLReason is “unspecified (0)”, but we - by mistake - did not take this condition into account

2023-07-15

  • the effective date of the new revocation requirements

2026-08-25

  • APPLE added a comment in CCADB to our root inclusion request CASE 00003342, raising this issue
  • 04:35 UTC (06:35 CEST)
    • Microsec received an email notification about the new CCADB comment
  • 08:00 UTC (10:00 CEST)
    • email was read and the investigation started regarding the issue
    • the improper handling of revocation reason was confirmed and decision was made to correct our processes
  • 13:03 UTC (15:03 CEST)
  • jira ticket was opened to review or public CP/CPS document
  • Microsec responded in CCADB to the comments and promised to review its CP/CPS and processes regarding the revocation reason codes

2026-08-26

  • 14:30 UTC (16:30 CEST)
    • Microsec opened this incident ticket in Mozilla's Bugzilla by providing the Preliminary Incident Report
  • 14:45 UTC (16:45 CEST)
    • Microsec opened an epic in jira to manage the tasks related to this incident.

2026-08-30

  • developments finished and the new solution was tested on our test system

2026-08-31

  • 06:00 UTC (09:00 CEST)
    • in the following three hours the new configurations and/or the new software versions were released in our production system
  • 09:00 UTC (12:00 CEST)
    • from this time, unspecified(0) revocation reason is supported also when clients request the revocation

2026-09-03

  • changes were made in the LATEX source of our CP/CPS and a draft version was produced

Related Incidents

There was no related incident.

Root Cause Analysis

**Contributing Factor 1: Incorrect closure of a development Jira epic **

  • Description:

    • Based on a correct interpretation of Mozilla’s revocation requirements, the jira epic defined the tasks to be completed in detail.
    • We planned to achieve full compliance in two phases.
    • After the first phase was completed, the ticket was closed by mistake, so some tasks were not completed.

  • Timeline:

    • see above

  • Detection:

    • The error was only discovered during the investigation of the incident.

  • Interaction with other factors:

    • Contributing Factor 2

  • Root Cause Analysis methodology used:

Contributing Factor 2: An Inaccurate Interpretation of the CABF BR Requirements

  • Description:

    • The Mozilla requirements, which had previously been correctly processed, appeared in the CABF BR document in practically unchanged form.
    • We did not use the results of the previous study in this new analysis, so the error made in that epic remained unnoticed.
    • During the new processing, one requirement was interpreted incorrectly.

  • Timeline:

    • see above

  • Detection:

    • The error was only discovered during the investigation of the incident.

  • Interaction with other factors:

    • Contributing Factor 1

  • Root Cause Analysis methodology used:

Lessons Learned

  • What went well:

    After receiving notification of the error, we responded quickly and corrected it.

  • What didn’t go well:

    The error persisted for over three years without being detected; it was brought to our attention by a third party.

  • Where we got lucky:

    The error did not affect the validity of the certificates; no certificates had to be revoked

  • Additional:

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 In progress
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-09-30 In progress
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-10-30 In progress

Appendix

MARKDOWN online editor 2 https://markdownlivepreview.com/ - ez jobb
MARKDOWN online editor https://dillinger.io/
MARKDOWN rules https://www.markdownguide.org/basic-syntax/
MARKDOWN tablesgenerator https://www.tablesgenerator.com/markdown_tables
MARKDOWN github rules https://docs.github.com/en/github/writing-on-github/basic-writing-and-formatting-syntax

  • [x] Finish my changes
  • [ ] Push my commits to GitHub
  • [ ] Open a pull request

Microsec: Insufficent support for "unspecified (0)" revocation reason

Status Report 2026-09-16

Progress in Action Items

#1 Issuance of Dedicated CP/CPS

2026-09-16

#2 Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements

  • thanks to the shared LaTeX source, significant progress has been made in the preparation of all our public documents.

#3 Final CP and CPS documents according to Hungarian requirements

  • there is no progress, as this task depends on the completion of Task #2

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-09-30 Ongoing
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-10-30 Ongoing

Status Report 2026-09-23

Progress in Action Items

#2 Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements

  • we are working on it and expect to finish it by the planned deadline.

#3 Final CP and CPS documents according to Hungarian requirements

  • there is no progress, as this task depends on the completion of Task #2

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-09-30 Ongoing
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-10-30 Ongoing

Status Report 2026-09-30

Progress in Action Items

#2 Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements

  • the originally planned changes have been incorporated into the draft regulations
  • in the meantime, new requirements have arisen that we would like to include in this version of the policy
  • due to new requirements, we have postponed the planned deadline by one week

#3 Final CP and CPS documents according to Hungarian requirements

  • there is no progress, as this task depends on the completion of Task #2
  • as a result of the change in the Task 2 deadline, this deadline has also been adjusted

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-10-07 Ongoing
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-11-06 Ongoing

Status Report 2026-10-08

Progress in Action Items

#2 Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements

  • The proposed changes have been incorporated into the draft regulations
  • The drafts have gone through the standard review and approval process and were officially published today
  • Action item #2 completed

#3 Final CP and CPS documents according to Hungarian requirements

  • The earliest planned date of entry into force was determined based on the date of the official publication of the drafts

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-10-08 Complete
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-11-08 Ongoing

Status Report 2026-10-14

Progress in Action Items

#3 Final CP and CPS documents according to Hungarian requirements

  • No user comments were received regarding the published drafts
  • The planned effective date has not changed

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-10-08 Complete
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-11-08 Ongoing

Status Report 2026-10-21

Progress in Action Items

#3 Final CP and CPS documents according to Hungarian requirements

  • No user comments were received regarding the published drafts
  • The planned effective date has not changed

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-10-08 Complete
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-11-08 Ongoing

Status Report 2026-10-28

Progress in Action Items

#3 Final CP and CPS documents according to Hungarian requirements

  • No user comments were received regarding the published drafts
  • The planned effective date has not changed

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Issuance of Dedicated CP/CPS Repair Root Cause # 2 CP/CPS is published 2026-09-16 Complete
Publishing draft CP and CPS documents according to eIDAS and Hungarian requirements Repair Root Cause # 2 Draft policy documents are published 2026-10-08 Complete
Final CP and CPS documents according to Hungarian requirements Repair Root Cause # 2 Policy documents are in effect 2026-11-08 Ongoing
You need to log in before you can comment on or make changes to this bug.