Camerfirma non-BR-compliant certificate issuance and remediation of invalid DNS names

This case concerns AC Camerfirma’s issuance of TLS/SSL certificates with non-BR-compliant DNS names, including URLs in dNSName SANs and internal server names. The issue was raised in Mozilla’s CA Program after reports in mozilla.dev.security.policy and direct email reports, and Mozilla asked Camerfirma to identify affected certificates, explain how the problem was discovered, and describe remediation and prevention steps. Camerfirma said it stopped issuing the problematic certificates, worked with customers to replace them, and revoked the affected certificates over time. The CA also described adding manual second review, technical DNSName controls in its PKI platform, and linting checks, and later said all reported certificates were revoked and the action items were completed. The bug was ultimately resolved FIXED.

1. 2015-07-23 A certificate later identified as containing internal server names was issued.
2. 2016-10-01 BR revocation deadline for certain internal-name certificates had passed without those certificates being revoked.
3. 2017-08-16 Mozilla opened the bug after reports of non-BR-compliant certificate issuance.
4. 2017-09-01 Camerfirma revoked one of the affected certificates.
5. 2017-09-12 Camerfirma revoked the remaining affected certificate referenced in the thread.
6. 2017-09-15 Camerfirma said its DNSName technical control was implemented.
7. 2018-03-02 Mozilla marked the bug resolved after the reported action items were completed.

1. 2017-08-16 Mozilla representative — Kathleen Wilson opened the bug and requested details on discovery, stopping issuance, affected certificates, root cause, remediation, and future prevention.
2. 2017-08-17 AC Camerfirma, S.A. — Ramiro Muñoz Muñoz said Camerfirma learned of the issue via the problem reporting address, had stopped issuing affected certificates, and was coordinating replacements with customers.
3. 2017-08-18 Community commenter — Ryan Sleevi asked for more detail on systemic causes, controls, and why the CA had not yet provided a fuller analysis.
4. 2017-08-23 Community commenter — Alex Gaynor said he had emailed Camerfirma on July 30 listing three non-compliant certificates and had not received a response.
5. 2017-08-24 AC Camerfirma, S.A. — Ramiro said all reported certificates were revoked except one, and described planned controls including daily review and certlint/x509lint checks.
6. 2017-09-06 AC Camerfirma, S.A. — Ramiro said one certificate remained to be revoked on September 11 and that Camerfirma had deployed a DNSName technical control.
7. 2017-11-30 AC Camerfirma, S.A. — Ramiro said Camerfirma had analyzed the root cause, revoked the internal-name certificates, and activated a control to avoid bad DNSName spellings.
8. 2017-12-21 AC Camerfirma, S.A. — Ramiro provided a fuller root-cause explanation, said all affected certificates were revoked, and described added staffing and process controls.
9. 2018-02-28 AC Camerfirma, S.A. — Ramiro reported the status of the action items, including implemented technical controls and updated procedures.
10. 2018-03-02 Fastly representative — Wayne Thayer said the action items appeared complete and marked the bug resolved.