Respond to a compromised CA key

Reconciliation reports a discrepancy between the HSM's signature counter and the ledger, or a report from outside suggests that an issuing CA's key has been misused.

You stop issuance for the affected CA, check your reporting obligations, revoke the CA in a ceremony at the root, and build a new CA generation. Partners add the new anchor to their relationships. The partners' own hierarchies are not affected.

sequenceDiagram
  participant M as Monitoring
  participant B as Operations
  participant W as CA worker
  participant Z as Ceremony at the root
  participant P as Partners and relying parties
  M->>B: discrepancy between HSM signature counter and ledger
  B->>W: stop issuance for the CA (rule set)
  B->>B: assess the situation, check reporting duty under the BSIG
  B->>Z: revocation order for the CA
  Z->>Z: root CRL with the CA revoked
  Z->>P: new root CRL
  B->>Z: new CA generation with a new key
  B->>P: reissue the affected certificates

1. Detect. Confirm the suspicion: reconcile the HSM's signature counters against the ledger, and weigh reports from outside. By default, reconciliation runs hourly.
2. Contain. Stop issuance for the affected CA in the rule set and set the key state to retired.
3. Report. Check the reporting obligation under Section 32 BSIG (24 hours, 72 hours, one month) and your contractual obligations toward partners.
4. Revoke. Revoke the CA in a ceremony at the root; the new root CRL reaches partners and relying parties.
5. Rebuild. Create a new CA generation with a new key, reissue the affected certificates, and distribute a new trust bundle. Tell your partners, who add the new anchor to their relationships.
6. Follow up. Record the root cause and the log, and adjust the measures.

Result. The compromised CA is revoked and its certificates are no longer valid; the new generation issues, and partners trust the new anchor.

• A compromised root takes a different path: the organization's hierarchy is rebuilt; see Operations and emergencies.
• Rehearse with a test CA: the “CA compromise” emergency test passes when the alarm, the stop of issuance, the revocation in the test ceremony, and the reporting path have all run.
• The “suspected compromise of a CA” notification goes to information security, the operations lead, and security management.

• Operations and emergencies
• PKI and certificate lifecycle – the root and ceremonies
• Trust model – what an attacker gains with which component