Camerfirma: MULTICERT certificates with a validity period greater than 825 days

Camerfirma reported that its subCA, MULTICERT, issued certificates with a validity period exceeding 825 days. The issue was discovered by Camerfirma's Quality Team, which prompted immediate action to halt further issuance of such certificates. MULTICERT identified a bug in their code that incorrectly set the notAfter date based on the original validity period rather than adhering to the Baseline Requirements. The CA implemented a fix and revoked the misissued certificates by December 12, 2018. The case is now resolved, with steps taken to prevent future occurrences, including the deployment of a lint tool for pre-issuance checks.

1. 2018-11-14 First misissued certificate detected
2. 2018-11-16 Camerfirma notifies MULTICERT of the misissuance
3. 2018-12-12 Revocation of misissued certificates completed

1. 2018-11-21 AC Camerfirma, S.A. — Reported the issue of MULTICERT certificates exceeding 825 days validity.
2. 2018-12-10 MULTICERT — Provided clarifications on the actions taken to resolve the issue.
3. 2019-01-02 Community commenter — Requested further root cause analysis and preventive measures.
4. 2019-02-14 AC Camerfirma, S.A. — Confirmed deployment of the lint tool for pre-issuance checks.