Visa: Non-BR-Compliant Certificate Issuance

RESOLVED FIXED Visa

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

This case involves Visa's disclosure of non-compliant certificate issuance practices. The CA was alerted to issues regarding invalid dnsNames and the inclusion of serverAuth key purposes in extended key usage, which were reported in the Mozilla Dev Security Policy Forum. Visa confirmed that they ceased issuing the problematic certificates and began remediation efforts, including revoking two certificates identified as non-compliant. The CA has committed to improving their processes to prevent future occurrences and has provided updates on their remediation timeline.

Model: gpt-4o-mini Generated: 2026-06-13 17:06 UTC Revised: 2026-06-16 18:13 UTC Confidence: 0.85 23 comments

Chronology

2017-08-16 Visa was notified of non-compliance issues in their certificate issuance.
2017-08-18 One problematic certificate was revoked.
2017-08-29 The second problematic certificate was scheduled for revocation.

Thread Activity

2017-08-16 Mozilla representative — Kathleen Wilson outlined the compliance issues found in Visa's certificates.
2017-08-17 Visa — Marcelo Silva confirmed awareness of the issues and stated that remediation was underway.
2017-08-18 Visa — Marcelo Silva reported that one certificate had been revoked.
2017-08-29 Visa — Marcelo Silva indicated that the second certificate would be revoked by the end of the day.

Participants

Mozilla representative Visa Titanous representative Community commenter

External References

Original Bugzilla Case

Related Bugzilla IDs Mentioned

#1029147

Similar Local Cases

#1315016 RESOLVED Self Reported Incident Opened 2016-11-03 · Closed 2022-11-14 · 100% similar

SHA-1 issuance by Visa root

AI Summary CA Owner

#1398261 RESOLVED Self Reported Incident Opened 2017-09-08 · Closed 2023-02-22 · 100% similar

Visa: Non-BR-Compliant OCSP Responders

AI Summary CA Owner

#1391056 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2017-08-16 · Closed 2023-02-22 · 90% similar

NetLock: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner

#1393557 RESOLVED Self Reported Incident Incident Opened 2017-08-24 · Closed 2023-02-22 · 90% similar

GlobalSign: Non-BR-Compliant Certificate Issuance -- RSA key smaller than 2048 bits

AI Summary CA Owner

#1390998 RESOLVED Self Reported Incident Certificate Misissuance Opened 2017-08-16 · Closed 2023-02-22 · 88% similar

Kamu SM: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner

#1390996 RESOLVED Self Reported Incident Opened 2017-08-16 · Closed 2023-02-22 · 87% similar

Entrust: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner

#1397969 RESOLVED Self Reported Incident Opened 2017-09-08 · Closed 2023-02-22 · 85% similar

DigiCert / Inteso San Paulo: Double dot characters

AI Summary CA Owner

#1390974 RESOLVED Certificate Misissuance Self Reported Incident Opened 2017-08-16 · Closed 2023-02-22 · 84% similar

Actalis: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner