← Asseco Data Systems S.A. cases
Bugzilla #1420860
Ca Certificate Compliance
Certificate Misissuance
Asseco DS / Certum: CAA Mis-Issuance on mix of wildcard and non-wildcard DNS names in SAN
RESOLVED
FIXED
Asseco Data Systems S.A.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns a potential misissuance by Certum related to the handling of CAA records for a certificate that included both wildcard and non-wildcard DNS names in its Subject Alternative Name (SAN). The issue was triggered by a report indicating that Certum may have bypassed CAA checks when issuing the certificate for the domain cyberbajt.pl. After investigation, Certum acknowledged that there was a misinterpretation of RFC 6844 regarding CAA validation. However, they later clarified that the certificate was issued correctly based on the CAA records available at the time of issuance. The case was ultimately resolved as 'FIXED' despite initial concerns about misissuance.
Chronology
- Certificate issued for cyberbajt.pl with mixed wildcard and non-wildcard SAN.
Thread Activity
- Scheitle representative — Filed a bug regarding potential CAA misissuance by Certum.
- Assecods representative — Confirmed improper processing of CAA records for wildcard certificates.
- Assecods representative — Clarified that the certificate was issued correctly based on the CAA records at the time.
- Fastly representative — Resolved the case as FIXED due to lack of evidence for misissuance.
Participants
Scheitle representative
Assecods representative
Fastly representative
External References
Similar Local Cases
Asseco DS / Certum: CAA mis-issuance on critical flag and unknown CAA tag
Asseco DS / Certum: EV Certificates issued with wrong Business Category
Asseco DS / Certum: Non-BR-Compliant Issuance - Debian Weak Keys
Asseco DS / Certum: EV certificate mis-issue
Asseco DS / Certum: CAA Mis-Issuance on CNAME pointing directly to restrictive CAA record
Asseco DS / Certum: commonName not from subjectAltName entries
Asseco DS / Certum: Cross-certificate with wrong policy identifier
Asseco DS / Certum: SMIME certificates with wrong organizationIdentifier