DigiCert: Mis-issuance of certificate with https in CN/SAN
This case concerns a misissuance incident involving a TLS/SSL certificate that contained an incorrect “https” string in the certificate’s Common Name (CN) and/or Subject Alternative Name (SAN). Cybertrust Japan (CTJ), an intermediate CA of DigiCert, discovered the misissued certificate through its regular quality-control checking using cablint on cert.sh. CTJ reported that it found the certificate during its daily check, contacted the customer, and revoked the certificate; it also patched its issuance system on Mar 14, 2018 to reject the problematic request. CTJ stated that it scanned certificates issued in the past and found only the one affected certificate. In the thread, CTJ explained that its front-end checking system could catch malformed SANs but missed this particular instance because it did not filter for the malformed CN; it later integrated pre-issuance checking into its issuance pipeline via a certificate linting program. The bug was resolved as FIXED after action items were completed and the matter was closed.
- The misissued certificate was issued.
- Cybertrust Japan discovered the misissued certificate during daily quality-control checking and contacted the customer.
- The misissued certificate was revoked.
- Cybertrust Japan patched its issuance system to reject the problematic request and integrated pre-issuance checking via a certificate linting program.
- Community commenter — Ben Wilson posted CTJ’s incident report describing how the misissued certificate was discovered, the revocation and system patch timeline, and that only one affected certificate was found.
- Fastly representative — Wayne Thayer asked Ben to also disclose the incident on mozilla.dev.security.policy and questioned why the cablint-style check was not performed prior to issuance.
- Community commenter — Ben Wilson explained CTJ’s front-end system missed the issue because it lacked a filter for the malformed Common Name, and stated the front-end system was patched.
- Fastly representative — Wayne Thayer requested confirmation that CTJ’s planned integration of pre-issuance checking into the issuance pipeline was completed.
- Community commenter — Ben Wilson stated CTJ had integrated pre-issuance checking into its issuance pipeline and that the matter should be closed.
- Fastly representative — Wayne Thayer confirmed action items were complete and resolved the bug.