E-Tugra: Improper DER results in failure to comply with RFC 5280 (invalid PrintableString characters)

The case concerns an E-Tugra certificate that fails to parse due to invalid characters in a Subject serialNumber field: the serialNumber contains an underscore (“_”), which is not valid for a PrintableString, and the certificate also includes a Subject attribute with a serialNumber field. Ryan Sleevi (Mozilla) provided an example certificate URL and stated it appears to be a misissued certificate and asked E-Tugra to provide an incident report. E-Tugra responded that it continued reviewing the case and later provided an incident report describing how it became aware of the problem and what actions it took. E-Tugra stated it revoked the affected certificates (including those reported in Bugzilla) and issued a replacement certificate for the certificate owner, with revocation planned “in a week” in the earlier response. E-Tugra also reported that it searched its certificate database and found no other certificates with the same problem, upgraded its pre-issue and post-issue control libraries, and rebuilt certificate issue controls based on RFC 5280 and CA/Browser Forum Baseline Requirements, with controls put into use on Jan 31. Fastly’s wthayer later commented that it appears remediation is complete, and the bug is marked RESOLVED with resolution FIXED.

1. 2018-05-18 A misissued E-Tugra certificate example was identified as failing to parse due to invalid PrintableString characters in a Subject serialNumber field.
2. 2019-01-03 E-Tugra revoked the certificates it identified as affected, including those reported in the Bugzilla case.
3. 2019-01-31 E-Tugra reported that system upgrades rebuilt certificate issue controls and that reasons for the problems were fixed with auto control and alerting introduced.
4. 2019-02-20 A reviewer stated it appears remediation is complete.

1. 2018-05-18 Community commenter — Provided an example certificate URL and explained it fails to parse because the Subject serialNumber contains an underscore, which is not valid for PrintableString.
2. 2018-05-18 Fastly representative — Agreed it appears to be a misissued certificate and requested an incident report posted to the mozilla.dev.security.policy forum and added to the bug.
3. 2018-05-25 E-Tugra — Said E-Tugra would provide an incident report as soon as possible.
4. 2019-01-08 E-Tugra — Explained that invalid certificates were issued during testing of a new intermediate CA, described three levels of certificate controls, and said a detailed report would be posted.
5. 2019-02-04 E-Tugra — Provided an incident-report style response including awareness sources, a timeline of issuance and revocation, and stated controls were rebuilt with pre-issue and post-issue changes.
6. 2019-02-20 Fastly representative — Thanked E-Tugra for the detailed response and said it appears remediation is complete.