KIR S.A.: Misissuance - missing OCSP AIA, Validity > 825 days

Krajowa Izba Rozliczeniowa S.A. (KIR) reported a misissuance incident involving a certificate that lacked an OCSP AIA and had a validity period exceeding 825 days. The issue was identified during a post-issuance linting procedure on January 14, 2019, leading to an investigation and subsequent revocation of the problematic certificate on January 21, 2019. KIR took corrective actions, including removing the registration policy that allowed the issuance of such certificates and implementing a patch from their software vendor to enhance compliance checks. The bug was resolved with the implementation of necessary changes and improvements to prevent future occurrences.

1. 2019-01-14 Misissuance identified during post-issuance linting.
2. 2019-01-21 Problematic certificate revoked.
3. 2019-06-13 Basic pre-linting patch deployed.

1. 2019-01-27 Kir representative — Reported the misissuance incident and provided steps to reproduce.
2. 2019-01-29 Fastly representative — Inquired about compliance with CPS and the status of pre-issuance linting.
3. 2019-02-01 Community commenter — Requested clarification on OCSP status of the misissued certificate.
4. 2019-07-08 Kir representative — Confirmed deployment of pre-linting patch and acknowledged communication issues.
5. 2019-09-16 Fastly representative — Noted delays in communication and resolved the bug.