← Netlock cases
Bugzilla #1391056
Ca Certificate Compliance
Self Reported Incident
NetLock: Non-BR-Compliant Certificate Issuance
RESOLVED
FIXED
Netlock
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
NetLock disclosed a compliance issue regarding the issuance of TLS/SSL certificates that contained invalid DNS names due to accented characters. The issue was first reported by a customer following the release of Android Chrome 58, prompting NetLock to investigate and identify additional misissued certificates. The CA confirmed that it has ceased issuing such certificates and has implemented measures to prevent future occurrences, including technical changes to validate DNS names. Affected certificates were revoked, and a detailed remediation plan was provided to Mozilla, including a timeline of actions taken. The case has been marked as resolved.
Chronology
- Customer reported a technical problem with a certificate.
- NetLock received a Mozilla bug ticket regarding non-compliance.
- Affected certificates were revoked.
Thread Activity
- Mozilla representative — Identified compliance issues in certificates issued by NetLock.
- Netlock — Confirmed awareness of the issues and actions taken to resolve them.
- Mozilla representative — Confirmed that fields in the CA Database will be updated.
- Netlock — Provided a detailed timeline of actions taken to address the compliance issues.
- Fastly representative — Marked the case as resolved after confirming all actions were completed.
Participants
Mozilla representative
Netlock
Titanous representative
Community commenter
Fastly representative
External References
Similar Local Cases
NetLock: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy
NetLock: Cumulative report connected to EV verification
NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit
Asseco DS / Certum: CAA Mis-Issuance on CNAME pointing directly to restrictive CAA record
Camerfirma: Govern d'Andorra audits
Disig: Non-BR-Compliant Certificate Issuance
DigiCert / Telecom Italia: Several Problems
SwissSign: Non-BR-Compliant Certificate Issuance