← Asseco Data Systems S.A. cases
Bugzilla #1409766
Certificate Misissuance
Asseco DS / Certum: CAA Mis-Issuance on CNAME pointing directly to restrictive CAA record
RESOLVED
FIXED
Asseco Data Systems S.A.
AI Summary
This case involved a misissuance of a certificate by Certum for the domain www.gazebear.online, which was a CNAME pointing to a domain with a restrictive CAA record. Certum issued the certificate despite the CAA record indicating that issuance should not occur. The issue was reported on October 16, 2017, and Certum acknowledged problems with CAA checking for subdomains. They implemented a fix and improved their CAA validation process, which was fully operational by September 11, 2018. The case was resolved with no further misissuances detected.
Chronology
- Issue reported to Certum
- Automated CAA verification improvements deployed
Participants
Quirin Scheitle
Wojciech Trapczyński
Gervase Markham
Arkadiusz Lawniczak
Wayne Thayer
Ryan Sleevi
External References
Similar Local Cases
Asseco DS / Certum: Invalid value in SAN dNSName
Asseco DS / Certum: CAA Mis-Issuance on mix of wildcard and non-wildcard DNS names in SAN
Asseco DS / Certum: CAA mis-issuance on critical flag and unknown CAA tag
Asseco DS / Certum: Non-BR-Compliant Issuance - Debian Weak Keys
Asseco DS / Certum: EV Certificates issued with wrong Business Category
NetLock: CN not in SAN
SwissSign: Invalid DNSName in SAN
DigiCert: RapidSSL CAA Mis-Issuance: Lookup failure on DNSSEC-signed zone