StartCom: mis-issuance of certificates with unvalidated domain names and bogus field values

This case concerns StartCom issuing certificates that contained unvalidated domain names and bogus field values. Mozilla staff noticed that StartCom had issued multiple obviously fake certificates and linked to public certificate transparency records. StartCom stated that the certificates were created for CT-log implementation testing due to problems caused by the “great firewall,” and that they were revoked immediately. StartCom also reported remediation steps to prevent recurrence and acknowledged an additional issue where CRL generation did not produce a new CRL at the time of revocation (it appeared in the next update). StartCom further said OCSP responses showed the certificates as revoked and that some additional certificates were not issued because the CT connection failed, though they appeared in crt.sh. The bug was resolved as FIXED, and later discussion noted potential overlap with another bug related to adding StartCom/Certinomis certificates to OneCRL.

1. 2017-06-01 StartCom issued test certificates with fake/unvalidated contents and revoked them immediately after noticing the issue.
2. 2017-06-01 StartCom provided an incident handling record describing the CT-log testing cause and remediation steps.
3. 2017-09-20 Mozilla staff discussed whether the case could be closed based on OneCRL inclusion for related certificates.

1. 2017-06-01 Mozilla representative — Reported that StartCom issued obviously fake certificates and provided crt.sh links, noting they would not be accepted but raised a policy-violation concern.
2. 2017-06-01 WoSign CA Limited — Created an incident handling record attachment.
3. 2017-06-01 WoSign CA Limited — Explained the certificates were generated for CT-log implementation testing, were revoked immediately, and described remediation steps and CRL/OCSP behavior.
4. 2017-06-01 WoSign CA Limited — Created a detailed screenshots attachment.
5. 2017-09-20 Community commenter — Suggested the issue may overlap with Bug 1386894 and that it could be closed if StartCom/Certinomis certificates are added to OneCRL.