PROCERT: Non-BR-Compliant Certificate Issuance

This case concerns PROCERT certificates that Mozilla participants identified as not complying with Baseline Requirements. The thread began with a Mozilla notice listing multiple problems, including invalid dNSName values, disallowed otherName entries in subjectAltName, reserved IP addresses, internal DNS names, and a common name not present in SAN. Additional comments raised concerns about non-random serial numbers and an OCSP responder that returned "good" for unknown serial numbers. PROCERT replied that some affected certificates were revoked, that replacement certificates would be issued, and that process changes were being made, including updates to CPS documentation and customer revocation procedures. The thread also records PROCERT saying it was working with Microsoft and its software vendor on the OCSP issue and that an annual audit document was attached. The bug was later marked a duplicate of bug 1403549.

1. 2017-08-16 Mozilla reported multiple non-BR-compliant PROCERT certificate issuance issues.
2. 2017-08-17 Additional PROCERT certificates were identified as misissued, including cases involving reserved IP addresses, internal DNS names, and a CN missing from SAN.
3. 2017-08-23 PROCERT said one certificate had been revoked and that other issues were being corrected or worked on.
4. 2017-09-06 PROCERT described corrective actions for serial numbers, certificate issuance controls, and OCSP behavior.
5. 2017-09-27 PROCERT said revocation had proceeded and that additional measures were added to its CPS and procedures.
6. 2017-10-18 The bug was marked a duplicate of bug 1403549.

1. 2017-08-16 Mozilla representative — Kathleen Wilson opened the bug with a list of reported certificate problems and requested PROCERT’s remediation details and updates.
2. 2017-08-16 Community commenter — PROCERT argued that the certificate issuance was compliant and that the SAN contents met its interpretation of the standards.
3. 2017-08-16 Community commenter — Ryan Sleevi explained why the SAN contents violated RFC 5280 and the Baseline Requirements and said the certificate was misissued.
4. 2017-08-17 Titanous representative — Jonathan Rudenberg identified three additional unrevoked misissued certificates and cited the relevant BR sections.
5. 2017-08-17 Mm representative — A commenter reported PROCERT issuing certificates with evidently non-random serial numbers and linked a batch list.
6. 2017-08-17 Mm representative — A commenter attached evidence that PROCERT’s OCSP responder returned "Good" for a non-existent certificate.
7. 2017-08-23 Procert representative — PROCERT said the certificate in comment #1 had been revoked and that the other issues were being corrected or worked on.
8. 2017-08-23 Community commenter — Alex Gaynor noted that the example certificate used in the OCSP discussion had a 1024-bit RSA key and asked for a full post-mortem and database scan.
9. 2017-08-23 Community commenter — Paul Kehrer explained that the OCSP issue remained unresolved because unknown serial numbers still returned "good".
10. 2017-08-24 Community commenter — PROCERT said it had not issued 1024-bit certificates since 2010 for end users and that affected certificates would be revoked and reissued within 48 hours.
11. 2017-08-25 Mozilla representative — Gerv clarified that the OCSP concern was about unknown serial numbers returning "good," which is prohibited by the Baseline Requirements.
12. 2017-08-29 Tds representative — A commenter said two of the certificates mentioned earlier were still unrevoked and one was still being served.
13. 2017-08-29 Community commenter — PROCERT said it was waiting for a customer maintenance window to issue new certificates and revoke the previous ones.
14. 2017-09-06 Community commenter — PROCERT described corrective actions for certificate issues, serial numbers, and OCSP behavior, and said it was contacting customers for prompt revocation and reissue.
15. 2017-09-20 Procert representative — PROCERT said it had an open ticket with Microsoft to resolve the OCSP issue.
16. 2017-09-27 Procert representative — PROCERT said revocation had proceeded and that additional measures were added to its CPS and SSL procedures.
17. 2017-10-02 Procert representative — PROCERT sent a longer response describing serial-number changes, revocation of the certificates named in the bug, and customer notification for reissue.
18. 2017-10-18 Mozilla representative — Gerv marked the bug as a duplicate of bug 1403549.