Hongkong Post e-Cert CA 1 - 10 issuing certificates without subject alternative name extension

The Hongkong Post e-Cert CA 1 - 10 was found to be issuing certificates that lacked the required subject alternative name (SAN) extension. This issue was identified by Mozilla's Dana Keeler, who noted that the CA had issued several such certificates, including one as recently as July 2016. In response, the CA confirmed that it had ceased issuing SSL certificates from this subCA as of January 1, 2016, and transitioned to a new BR-compliant subCA. The CA has since taken steps to ensure compliance with the Baseline Requirements. The issue was ultimately resolved by adding the problematic certificates to OneCRL.

1. 2016-04-25 Discovery of non-compliant certificates issued by Hongkong Post e-Cert CA 1 - 10.
2. 2016-08-31 Certificates from Hongkong Post e-Cert CA 1 - 10 added to OneCRL.

1. 2016-04-25 Mozilla representative — Hongkong Post e-Cert CA 1 - 10 has been issuing certificates that do not have a subject alternative name extension.
2. 2016-04-27 Certizen representative — "Hongkong Post e-Cert CA 1 - 10" is an old SHA-1 subCA which had been stopped issuing SSL certificates since 1 January 2016.
3. 2016-08-12 Mozilla representative — This was issued from "Hongkong Post e-Cert CA 1 - 10" in July, so there still appears to be an issue here.
4. 2016-08-16 Mozilla representative — This is in direct violation of the CA/Browser Forum's Baseline requirements.
5. 2016-11-29 Mozilla representative — Closing this bug as resolved/fixed, because the 'Hongkong Post e-Cert CA 1 - 10' certificates were added to OneCRL.