Asseco Data Systems / Certum: Use of forbidden subjectPublicKeyInfo algorithm (P-521)

This case concerns certificates issued by Asseco Data Systems S.A. / Certum that used a forbidden subjectPublicKeyInfo algorithm, specifically P-521 keys. The issue was reported in the mozilla.dev.security.policy forum and referenced in Bugzilla bug 1518560, with Mozilla requesting an incident report from the CA. In response, the CA stated it had stopped issuing certificates that include P-521 keys and provided an incident timeline and details of the problematic certificate(s). The CA explained that after Mozilla Root Store Policy v2.4 (released Feb 28, 2017), it did not change allowed public key algorithms accordingly, and that the team responsible for policy inspection did not report the change to the product manager. As remediation, the CA described team monitoring of CA/B Forum and browser policy changes, regular meetings, and a process to implement and then review compliance after changes. The CA also stated it created documentation comparing technical requirements from browser policies (including CA/Browser Forum BR) and reviewed operational practices, reporting no non-conformity; the bug was resolved as FIXED.

1. 2017-02-28 Mozilla Root Store Policy v2.4 was released.
2. 2018-11-28 A certificate including P-521 keys was issued.
3. 2019-01-08 Bugzilla bug 1518560 was created after the issue was reported in mozilla.dev.security.policy.
4. 2019-01-09 The CA blocked issuing certificates that include P-521 keys.
5. 2019-02-04 The CA reported completion of documentation comparing technical requirements and stated operational practices were reviewed.

1. 2019-01-08 Community commenter — Requested an incident report and listed the reported problem as P-521 in certificates, linking to the mozilla.dev.security.policy discussion.
2. 2019-01-09 Asseco Data Systems S.A. — Acknowledged that an incident report would be provided soon.
3. 2019-01-14 Community commenter — Asked for weekly updates per Mozilla guidance.
4. 2019-01-16 Asseco Data Systems S.A. — Provided an incident report including awareness, timeline, statement that issuing with P-521 keys was stopped, and remediation steps.
5. 2019-01-16 Community commenter — Asked for more detail on processes and procedures to ensure future compliance.
6. 2019-01-21 Asseco Data Systems S.A. — Described a monitoring and implementation process for policy changes and an additional action to review browser policies and draw up technical differences.
7. 2019-01-23 Fastly representative — Requested an update when the browser-policy comparison documentation work was completed.
8. 2019-02-04 Asseco Data Systems S.A. — Reported that documentation was created to compare technical requirements and that operational practices were reviewed with no non-conformity found.