KIR S.A.: Certificates issued with multiple BR violations

Krajowa Izba Rozliczeniowa S.A. (KIR) reported multiple baseline requirements (BR) violations related to certificates issued from the SZAFIR ROOT CA2. The issues included invalid postal addresses, improper Subject Alternative Names (SANs), and missing state or locality fields in organization names. KIR began preparing an incident report on October 2, 2018, and confirmed that they stopped issuing non-compliant certificates. They also implemented remediation steps, including fixing certificate policy templates and enhancing validation procedures. The case is now resolved with KIR having completed all necessary actions.

1. 2018-10-01 KIR S.A. discovered multiple BR violations in issued certificates.
2. 2019-09-16 All questions have been answered and remediation is complete.

1. 2018-10-01 Fastly representative — CABLint, X509Lint, and ZLint identified multiple errors with certificates issued from the SZAFIR ROOT CA2.
2. 2018-10-02 Kir representative — KIR started preparing the incident report.
3. 2018-10-08 Fastly representative — KIR provided a detailed incident report outlining the timeline and actions taken.
4. 2019-01-09 Kir representative — KIR confirmed implementation of post-issuance linting as part of their certificate issuance process.
5. 2019-06-17 Kir representative — KIR reported that the problem was identified and resolved, and validation processes have improved.
6. 2019-09-16 Fastly representative — It appears that all questions have been answered and remediation is complete.