Telia: Misissued certificate - FQDN without domain part (e_dnsname_not_valid_tld)

Telia reported a certificate compliance issue it discovered during its own mass lint scanning of SSL certificates. On February 8, 2019, Telia performed a mass lint scan to find invalid certificates and found nine previously unknown invalid certificates across multiple error categories; this bug covers the case of a certificate with an FQDN value without a domain part (e_dnsname_not_valid_tld). Telia’s preliminary analysis concluded the certificate should be revoked within 24 hours and must be revoked within 5 days under BR 4.9.1.1. Telia performed root cause analysis and stated it had added FQDN verification code, but that in this particular case the CSR was incorrectly accepted due to an error-handling bug; Telia also said it had not previously lint-checked older certificates. Telia revoked the affected certificate on February 15, 2019, but the original revocation attempt failed; operators later revoked it successfully after the failure was identified. Telia stated it modified its process to verify all lint revocations within 5 days, and reported that it had not reproduced the error after this incident. The bug is marked RESOLVED with resolution FIXED, and a later comment stated remediation was complete.

1. 2019-02-08 Telia discovered nine invalid certificates during a mass lint scan of its SSL certificates, including one with an FQDN without a domain part.
2. 2019-02-15 Telia revoked the affected certificate, after identifying that the initial revocation attempt had failed.

1. 2019-02-15 Teliasonera representative — Telia described how it found nine invalid certificates via a mass lint scan and identified this bug’s specific case (e_dnsname_not_valid_tld) and the revocation/revocation-failure details.
2. 2019-02-18 Teliasonera representative — Telia provided the PEM for the affected certificate.
3. 2019-02-18 Tds representative — A link to crt.sh was added for the certificate.
4. 2019-04-30 Mozilla representative — The bug type was corrected to a task.
5. 2019-08-11 Fastly representative — A comment stated that all questions had been answered and remediation was complete.