Telekom Security: Revocation delay for TLS certificates

Telekom Security faced a revocation delay for TLS certificates with basicConstraints not marked as critical, affecting 336 certificates. The issue stemmed from enterprise customers using these certificates in critical infrastructures. Despite efforts to prompt customers to replace and revoke the affected certificates within 5 days, not all were able to do so due to the complexity of their infrastructures. Telekom Security communicated with customers through various means, including emails, phone calls, and video conferences, to ensure compliance. Lessons learned included the need for customer sensitization and preparation for faster certificate replacement procedures. Automation via protocols like ACME was considered for future issuance processes. While some stakeholders questioned the delay in revocation, Telekom Security defended its decision based on the perceived low security risk and the potential impact on critical infrastructures. The incident highlighted the challenges CAs face in ensuring timely revocation and the importance of continuous improvement to meet industry standards and maintain trust.