← Trustis cases
Bugzilla #1017562
Certificate Misissuance
Trustis: Certificate not version 3
RESOLVED
FIXED
Trustis
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Trustis issuing a version 1 certificate, which does not comply with Mozilla's policy requiring TLS end-entity certificates to contain a subjectAltName extension. The issue was identified by Kurt Roeckx, prompting Kathleen Wilson to request an investigation. Rob Horne from Trustis confirmed that the certificate was issued due to a technical problem related to browser updates affecting the RA portal. Trustis has since revoked the problematic certificate and is conducting a root cause analysis, implementing additional checks to prevent future occurrences. The case is now resolved.
Chronology
- Trustis issued a version 1 certificate that does not comply with Mozilla's policy.
- Trustis revoked the version 1 certificate and committed to issuing a replacement.
- Trustis identified the root cause of the issue related to browser compatibility and implemented corrective actions.
Thread Activity
- Roeckx representative — Reported seeing a version 1 certificate from Trustis.
- Mozilla representative — Requested investigation into the issuance of a version 1 certificate.
- Trustis representative — Confirmed the version 1 certificate was revoked and a replacement would be issued.
- Trustis representative — Reported findings on the root cause related to browser updates affecting certificate issuance.
Participants
Community commenter
External References
Similar Local Cases
Trustis: SHA-1 serverAuth cert issued in November 2016
SwissSign: Two certs issued with same issuer and serial number
TrustCor: Non-audited intermediate certificates
DigiCert / Swiss Government: CommonName not in SANs
GlobalSign CloudSSL CA - SHA256 - G3 issued certificate without required extensions
SwissSign: duplicate serial number
Visa: Issuing 1024 bit certificates
SwissSign: Certificate with key length 4098 bit