Certum issued certificates with invalid dnsNames containing IP addresses; revocation not yet completed

This case was opened by an external reporter who notified Certum/Asseco Data Systems about certificates containing invalid dnsNames with IP addresses. The reporter stated they emailed Certum’s problem reporting address on 2019-01-29 and received confirmation that Certum was investigating on 2019-01-30, but that none of the certificates had been revoked yet. Mozilla staff asked for an Incident Report regarding the issue and the failure to revoke. The Certum representative indicated that the bug likely duplicated another bug they had submitted previously and asked where to reply. The thread was marked as a duplicate of bug 1524195. The bug is currently resolved as a duplicate.

1. 2019-01-29 Reporter notified Certum/Asseco Data Systems about certificates with invalid dnsNames containing IP addresses via the problem reporting address.
2. 2019-01-30 Certum/Asseco Data Systems confirmed it was investigating the reported certificates.
3. 2019-02-04 Mozilla requested an Incident Report covering the issue and the failure to revoke.
4. 2019-02-04 The bug was marked as a duplicate of bug 1524195.

1. 2019-02-03 Titanous representative — Reported that Certum issued certificates with invalid dnsNames containing IP addresses, provided crt.sh links, and said none had been revoked yet after confirming investigation.
2. 2019-02-04 Community commenter — Asked Wojciech to provide an Incident Report regarding the issue and the failure to revoke, referencing Mozilla guidance.
3. 2019-02-04 Asseco Data Systems S.A. — Said bug 1524878 likely duplicates bug 1524195 and asked whether to reply in one or both bugs.
4. 2019-02-04 Fastly representative — Instructed the reporter to respond in the bug they created and noted the bug was marked as a duplicate of bug 1524195.