← China Financial Certification Authority (CFCA) cases
Bugzilla #1524733
Certificate Misissuance
CFCA: invalid dnsNames
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) disclosed a compliance issue involving two certificates issued with invalid dnsNames. The issue was reported by Jonathan Rudenberg on January 28, 2019, and CFCA revoked both certificates on the same day. In response, CFCA implemented a 'Hard fail' detection mechanism and improved their internal auditing processes to prevent future occurrences. They have also committed to ongoing training for their staff regarding Baseline Requirements. The issue has been resolved, and CFCA has confirmed that they have stopped issuing certificates with similar problems.
Chronology
- CFCA revoked two certificates with invalid dnsNames after being notified.
- CFCA implemented a 'Hard fail' detection mechanism to prevent future misissuance.
Thread Activity
- Titanous representative — CFCA issued two certificates with invalid dnsNames and reported them.
- Community commenter — CFCA confirmed the revocation of the certificates and outlined steps taken to prevent future issues.
- Fastly representative — It appears that all questions have been answered and remediation is complete.
Participants
Community commenter
External References
Similar Local Cases
CFCA: Internal iPAddress in certificate
CFCA: Invalid TLD in SAN
CFCA: Wrong SerialNumber encoding
CFCA: O > 64 characters
CFCA: certificate basicConstraints extension not marked as critical
Izenpe: Non-BR-Compliant Certificate Issuance
Kamu SM: "Some-State" in stateOrProvinceName
Entrust: Certificate issued with validity greater than 825-days