2088047 - Atos: Failure to respond to Certificate Problem Report within 24 hours

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Michael Mauss]

Preliminary Incident Report

Summary

• Incident description: Atos received a message on 2026-10-23 at 11:19. The sender informed us about a non-compliant OCSP Responder certificate. Response was provided on 2026-10-26 at 07:16.
• Relevant policies: Baseline Requirements Version 2.3.1 Section 4.9.5
• Source of incident disclosure: During investigation of the ticket 2085712

Comment 1

[Michael Mauss]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000004
• Incident description: On 2026-10-23, 11:19, Atos received a Certificate Problem Report that was not responded within 24 hours. Respond was sent on 2026-10-26, 07:16. The non-compliance was identified during the review of the Full Incident Report for ticket 2085712
• Timeline summary:
  • Non-compliance start date: 2026-10-24 - 11:19
  • Non-compliance identified date: 2026-11-02 - 13:10
  • Non-compliance end date: 2026-10-26 - 07:16
• Relevant policies: Baseline Requirements for the Issuance and Management of Publicly‐Trusted TLS Server Certificates 4.9.5
• Source of incident disclosure: Self Reported

Impact

• Total number of certificates: 0
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: N/A
• Incident heuristic: N/A
• Was issuance stopped in response to this incident, and why or why not?: No, no certificates impacted
• Analysis: N/A
• Additional considerations: This ticket is related to ticket 2085712 for which Atos failed to respond to CPR within 24 hours.

Timeline

2026-10-23 11:19 - Certificate Problem Report received
2026-10-23 15:04 - Investigation started
2026-10-24 11:19 - Non-compliance start date; 24-hour response time missed
2026-10-26 07:24 - Response provided to the reporter
2026-10-30 14:30 - Completion of the Full Incident Report for ticket 2085712 and handover to reviewer
2026-11-02 12:30 - Review started
2026-11-02 13:10 - non-compliance detected
2026-11-02 13:35 - Preliminary incident report published in Bugzilla

Related Incidents

Bug	Date	Description
2076163	2026-09-28	Failure to respond to a certificate problem report within 24 hours.
2073548	2026-09-18	Failure to respond to a certificate problem report within 24 hours.
2071832	2026-09-14	Failure to respond to a certificate problem report within 24 hours.
2060785	2026-08-05	Failure to respond to a certificate problem report within 24 hours.
2058920	2026-07-29	Failure to respond to a certificate problem report within 24 hours.
2057919	2026-07-26	Failure to respond to a certificate problem report within 24 hours.
2055542	2026-07-16	Failure to respond to a certificate problem report within 24 hours.
2054464	2026-07-13	Failure to respond to a certificate problem report within 24 hours.
2052541	2026-07-03	Failure to respond to a certificate problem report within 24 hours.
2016066	2026-02-11	Failure to respond to a certificate problem report within 24 hours.
2014833	2026-02-05	Failure to respond to a certificate problem report within 24 hours.
2005762	2025-12-12	Failure to respond to a certificate problem report within 24 hours.
2004704	2025-12-08	Failure to respond to a certificate problem report within 24 hours.
2004698	2025-12-08	Failure to respond to a certificate problem report within 24 hours.
1994454	2025-10-15	Failure to respond to a certificate problem report within 24 hours.
1985466	2025-08-27	Failure to respond to a certificate problem report within 24 hours.
1970727	2025-06-05	Failure to respond to a certificate problem report within 24 hours.
1967929	2025-05-22	Failure to respond to a certificate problem report within 24 hours.
1963629	2025-04-30	Failure to respond to a certificate problem report within 24 hours.
1959733	2025-04-10	Failure to respond to a certificate problem report within 24 hours.
1927675	2024-10-29	Failure to respond to a certificate problem report within 24 hours.

Root Cause Analysis

Contributing Factor #1: Automated email forwarding to the correct team failed.

• Description: As described in the Atos CP/CPS, one way to report issues is to use the Atos website and fill out a contact form there. This contact form generates a predefined email with a predefined subject and a predefined recipient. The recipient is a central Mailbox address of the PKI team. This mailbox is configured to forward emails with a specific subject line to a team that is available 24x7. In case like certificate issues or compliance issues, this team informs the Atos compliance team by telephone. The email forwarding rules for the 24x7 team were configured to apply only to the predefined subject lines from the contact form. The received email was sent with a different subject line.
• Timeline: Pre-existing - The rules have been in use for a long time. It became relevant on 2026-10-24 when Atos failed to respond to the problem report in a timely manner.
• Detection: Found during this investigation.
• Interaction with other factors: NA
• Root Cause Analysis methodology used: 5 Whys

Contributing Factor #2: Lack of explanation in the Atos CP/CPS regarding how to handle the email subject line for problem reports.

• Description: The CP/CPS describes the procedure for contacting Atos in the event of a problem. The CP/CPS does not specify the importance of the email subject line. As a result, CPR or other problems may be sent to Atos with a modified subject line.
• Timeline: Pre-existing - 2020-01-14 - procedure was added to CP/CPS
• Detection: Found during this investigation.
• Interaction with other factors: Factor #1: the missing Information led to the failed email forwarding.
• Root Cause Analysis methodology used: 5 Whys

Contributing Factor #3: Lack of explanation on the website for the contact form regarding how to handle the email subject line.

• Description: The contact form allows senders to change the subject line. This can result in emails not being processed correctly. The website does not inform the user about the importance of the email subject line.
• Timeline: Pre-existing - 2019 - procedure was added to website
• Detection: Found during this investigation.
• Interaction with other factors: Factor #1: the missing Information led to the failed email forwarding.
• Root Cause Analysis methodology used: 5 Whys

Contributing Factor #4: The administrator on duty, who checked the technical mailbox, failed to follow the requirement to respond within 24 hours.

• Description: Since the alerting channels did not function in this instance, the problem report remained stuck in the Inbox which is monitored by the technical team. The technical team began investigating the report that same day and correctly assessed the issue. It was overlooked that a response must take place within 24 hours.
• Timeline:
  2026-10-23 11:19 - CPR received
  2026-10-23 15:04 - Checking Mailbox, start of Investigation
  2026-10-24 11:19 - Non-compliance start date; 24-hour response time missed
• Detection: Found during this investigation.
• Interaction with other factors: NA
• Root Cause Analysis methodology used: 5 Whys

Lessons Learned

• What went well: The technical team correctly identified that a revocation is necessary within 5 days.
• What didn’t go well: Implemented procedures did not trigger an alert to the compliance team. The technical team overlooked the requirement that a response must be provided within 24 hours and failed to inform the compliance team..
• Where we got lucky: N/A
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Have the compliance team check the central PKI mailbox several times a day until all action items have been implemented.	Prevent	Root Cause # 1 # 2 # 3	Reminder is set and Mailbox is checked	2026-11-02	Complete
Update rules for email forwarding.	Prevent	Root Cause # 1	Emails with subjects like "Certificate Problem Report" are automatically forwarded to the correct Team.	2026-11-02	Complete
On a weekly bases, raise the technical team’s awareness regarding deadlines and reporting procedures for problem reports, and ensure that emails with incorrect subject lines are handled correctly and in a timely manner.	Detect	Root Cause # 4	The topic is at the top of the slide that is shown during team meetings.	2026-11-05	Complete
Update CP/CPS with Information about the emails subject line.	Prevent	Root Cause # 2	New CP/CPS released.	2026-11-13	Ongoing
Update Website with Information About the emails subject line.	Prevent	Root Cause # 3	Information on Website updated.	2026-11-13	Ongoing

Comment 2

[Michael Mauss]

All the action items are completed.
Updated Action Items:

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Have the compliance team check the central PKI mailbox several times a day until all action items have been implemented.	Prevent	Root Cause # 1 # 2 # 3	Reminder is set and Mailbox is checked	2026-11-02	Complete
Update rules for email forwarding.	Prevent	Root Cause # 1	Emails with subjects like "Certificate Problem Report" are automatically forwarded to the correct Team.	2026-11-02	Complete
On a weekly bases, raise the technical team’s awareness regarding deadlines and reporting procedures for problem reports, and ensure that emails with incorrect subject lines are handled correctly and in a timely manner.	Detect	Root Cause # 4	The topic is at the top of the slide that is shown during team meetings.	2026-11-05	Complete
Update CP/CPS with Information about the emails subject line.	Prevent	Root Cause # 2	New CP/CPS released.	2026-11-13	Complete
Update Website with Information About the emails subject line.	Prevent	Root Cause # 3	Information on Website updated.	2026-11-13	Complete

Comment 3

[Michael Mauss]

Report Closure Summary

• Incident description: On 2026-10-23, 11:19, Atos received a Certificate Problem Report that was not responded within 24 hours. Respond was sent on 2026-10-26, 07:16. The non-compliance was identified during the review of the Full Incident Report for ticket 2085712
• Incident Root Cause(s): The CPR was not processed correctly, for several reasons. Atos did not provide sufficiently detailed instructions to the reporter regarding the reporting procedure. As a result, the reporting chain to the compliance team failed, and the email got stuck in the technical mailbox. The person of the technical team handling the case overlooked that a response was required within 24 hours.
• Remediation description: Atos has revised the email forwarding rules, clarified the importance of the email subject line in the contact form and in CP/CPS, and reminded the technical team of the importance of providing feedback to the person who submitted the request.
• Commitment summary: All action items have been implemented. To avoid failed responses to problem reports caused by faulty automated forwarding, Atos commits to regularly sensitizing its technical team to the importance of responding promptly to Problem reports.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 4

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-11-19.