Asseco Data Systems S.A. / Certum: Invalid dNSName in SAN (IP addresses)

This case concerns certificates issued by Asseco Data Systems S.A. (Certum) that contained IP addresses in the Subject Alternative Name (SAN) dNSName field, which was reported as invalid dNSName. The CA said it became aware of the issue after receiving an email from Jonathan Rudenberg on January 30, 2019 listing unexpired and unrevoked SSL certificates with invalid dNSName in SAN. The CA stated it had stopped issuing such certificates on May 31, 2017, but initially decided not to revoke the previously issued certificates. After receiving the report, the CA decided to revoke those certificates and began notifying customers on January 30, 2019, with revocation scheduled until February 15, 2019 14:00 UTC as an exception to allow customer replacement time. The CA later confirmed that all those certificates were revoked. Mozilla’s reviewer asked about the CA’s auditor notification regarding the revocation-deadline exception, and the CA responded that it would notify its auditor during the next audit. The reviewer later stated that remediation was complete.

1. 2017-05-31 CA stopped issuing certificates with IP address in SAN dNSName.
2. 2019-01-30 CA received an external report listing unexpired certificates with invalid dNSName in SAN.
3. 2019-01-30 CA started notifying customers about the issue and planned revocation.
4. 2019-02-15 CA revoked the affected certificates.
5. 2019-02-21 CA stated it would notify its auditor during the next audit.
6. 2019-07-01 Mozilla stated remediation was complete.

1. 2019-01-31 Asseco Data Systems S.A. — Reported that the CA issued certificates with IP addresses in SAN dNSName and said it would send an incident report.
2. 2019-02-04 Fastly representative — Noted that Bug 1524878 was marked as a duplicate of this bug.
3. 2019-02-07 Asseco Data Systems S.A. — Provided a detailed incident timeline, including stopping issuance on May 31, 2017, deciding to revoke after the January 30 report, and planning revocation by Feb 15, 2019 as an exception.
4. 2019-02-15 Asseco Data Systems S.A. — Confirmed that all the affected certificates were revoked.
5. 2019-02-15 Fastly representative — Asked whether the CA notified its auditor about the revocation-deadline violation/exception and what would be done to avoid future exceptions.
6. 2019-02-21 Asseco Data Systems S.A. — Explained the CA’s rationale for delaying revocations and said it would notify its auditor during the next audit.
7. 2019-07-01 Fastly representative — Stated that it appears all questions were answered and remediation is complete.