← Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) cases
Bugzilla #1495507
Self Incident Disclosure
FNMT: OU exceeds 64 characters
RESOLVED
FIXED
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The Government of Spain's CA, Fábrica Nacional de Moneda y Timbre (FNMT), discovered that it had misissued 103 certificates with an Organizational Unit (OU) field exceeding the maximum length of 64 characters. This issue was initially reported by Wayne Thayer, prompting FNMT to conduct an internal investigation. They confirmed the misissuance and outlined a remediation plan, which included replacing the affected certificates and implementing automated validations to prevent future occurrences. The CA has since stopped issuing certificates with this problem and has added the misissued certificates to Certificate Transparency logs. The issue has been resolved as of January 2019, with all remediation measures completed.
Chronology
- FNMT received a report about misissued certificates with OU exceeding 64 characters.
- FNMT upgraded their PKI software to implement pre-issuance validations.
- FNMT completed the upgrade of their production environment with new validation rules.
Thread Activity
- Fastly representative — FNMT has misissued a number of certificates with an OU field that exceeds the maximum length of 64 characters.
- Community commenter — FNMT confirmed the issue and began an analysis of the affected certificates.
- Community commenter — Automated validation control was enabled, preventing further issuance of problematic certificates.
- Fastly representative — It appears that all remediation is complete.
Participants
Community commenter
External References
Similar Local Cases
FNMT: Certificates issued included Policy qualifiers other than id-qt-cps
FNMT: Findings in 2019 Audit Statement, including domain validation methods, CAA, etc.
FNMT: Missisuance of web site certificates without CA/Browser Forum’s reserved policy OID
FNMT: Incorrect publication of information for Test Website - Valid
FNMT: CP/CPS lack CAA processing details
FNMT: CP/CPS, Revocation Requests Mechanism, Certificate Problem Report, CRL and OCSP disruption
FNMT: LDAP URI in CRL Distribution Points Extension
FNMT: Issuance of QCP-n certificates without verifying identity