Telia: misissued certificate - FQDN value incorrectly in SAN rfc822 field

Telia opened this case after it discovered, via a mass zlint/lint scan of its SSL certificates, that it had previously issued invalid certificates. The scan (performed on February 8, 2019) found nine invalid certificates across multiple error categories, including one certificate with an FQDN value incorrectly placed in the SAN rfc822 field. Telia stated that the problematic certificate had CN value "puolukka.cover.sonera.net" and serial 66429e46fea54a99d27a0858c0794768, created on September 26, 2016. Telia reported that it performed preliminary analysis and decided the certificate should be revoked within 24 hours and must be revoked within 5 days, and that it was revoked by Telia on February 8, 2019. Telia also reported that it stopped using the CA console GUI that caused the issue in early 2018 and that the issuer creating these technical certificates was closed in 2018, with certificate profiles preventing use other than SAN DNS or SAN IP. In a later comment, w**********r@fastly.com stated that all questions had been answered and remediation was complete. The bug is marked RESOLVED with resolution FIXED.

1. 2016-09-26 Telia issued the affected certificate with CN "puolukka.cover.sonera.net" and serial 66429e46fea54a99d27a0858c0794768.
2. 2019-02-08 Telia discovered the issue via a mass lint scan and revoked the affected certificate.
3. 2019-02-11 Telia performed quick analysis confirming the similar error could not happen in current systems.
4. 2019-02-15 Telia completed root cause analysis and described remediation steps in the bug.
5. 2019-08-11 A participant stated remediation was complete.

1. 2019-02-15 Teliasonera representative — Telia reported that a mass lint scan on Feb 8, 2019 found 9 invalid certificates, including one with an FQDN value incorrectly in the SAN rfc822 field, and described analysis and revocation.
2. 2019-02-18 Teliasonera representative — Telia provided the PEM for the problematic certificate.
3. 2019-02-18 Tds representative — A link to crt.sh was posted for the certificate.
4. 2019-04-30 Mozilla representative — The bug type was corrected to a task.
5. 2019-08-11 Fastly representative — w**********r@fastly.com stated that all questions had been answered and remediation is complete.