← Atos cases
Bugzilla #1329223
Ca Certificate Compliance
Certificate Misissuance
Opened By Researcher
Single Ca Owner
Duplicate Or Superseded
Atos duplicate serial numbers in intermediate certificates
RESOLVED
DUPLICATE
Atos
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns two Atos intermediate certificates that were issued with the same issuer and serial number. The reporter identified duplicate serial numbers in the Atos TrustedRoot CodeSigning-CA 2011 and Atos TrustedRoot Server-CA 2011 intermediates and linked to the affected certificates on crt.sh. Mozilla asked Atos to explain what controls were in place to prevent duplicate serial-number issuance, noting that the certificates had already been revoked and were created before the first BR effective date of 2012-07-01. Atos replied that the issue had already been discussed during its root inclusion request. Mozilla then marked the bug as a duplicate of Bug 711366 and resolved it as DUPLICATE.
Chronology
- Two Atos intermediate certificates were identified with duplicate issuer and serial numbers.
- Mozilla asked Atos to explain what mechanisms prevent duplicate serial-number issuance.
- Mozilla resolved the bug as a duplicate of Bug 711366.
Thread Activity
- Sectigo — Reported duplicate serial numbers in two Atos intermediate certificates and provided crt.sh links.
- Mozilla representative — Noted the certificates were revoked and asked Atos to describe controls preventing duplicate serial numbers.
- Atos — Said the issue had already been discussed during Atos's root inclusion request.
- Mozilla representative — Stated the matter was previously resolved and marked the bug a duplicate of Bug 711366.
Participants
Sectigo
Mozilla representative
Atos
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
StartCom: Non-BR-Compliant Certificate Issuance -- adding Certnomis intermediates to OneCRL
Sectigo: Certificates with RSA keys where modulus is not divisible by 8
StartCom: mis-issuance of certs with unvalidated domain names and bogus field values
Let's Encrypt: certs issued contrary to CPS due to incomplete blocklist
SHA-1 issuance by DocuSign root
DigiCert: Non-BR Compliant Certificates - missing CP/CPS OID
D-Trust: issuing 1024 bit certificates
Consorci AOC: Non-BR-Compliant Certificate Issuance