← Visa cases
Bugzilla #1391087
Certificate Problem Report
Visa: Non-BR-Compliant Certificate Issuance
RESOLVED
FIXED
Visa
AI Summary
Visa faced issues with the issuance of non-Baseline Requirements (BR) compliant certificates, particularly concerning invalid dnsNames and missing serverAuth key purposes. The problems were reported in the Mozilla security policy forum, prompting Visa to confirm that they ceased issuing such certificates and began remediation efforts. They provided a timeline for revocation and replacement of the problematic certificates, with commitments to improve their compliance processes. Visa acknowledged the need for better internal handling of problem reports and has since updated their procedures to ensure timely responses.
Chronology
- Problems reported in Mozilla security policy forum.
- First problematic certificate revoked.
- Second problematic certificate scheduled for revocation.
Participants
Kathleen Wilson
Marcelo B. Silva
Jonathan Rudenberg
Ryan Sleevi
Jason Crawford
Gervase Markham
External References
Similar Local Cases
Camerfirma: Non-BR-Compliant Certificate Issuance
Consorci AOC: Non-BR-Compliant Certificate Issuance
DocuSign/Keynectis: Non-BR-Compliant OCSP Responders
GlobalSign: Non-BR-Compliant Certificate Issuance -- RSA key smaller than 2048 bits
Visa: Issuing 1024 bit certificates
Firmaprofesional: Non-audited, non-technically-constrained intermediate certificates
GoDaddy: New GoDaddy incorrect issuance bug appears to be regression of 2010 issue
SECOM: Non-BR-Compliant OCSP Responders