Izenpe: OU > 64 characters

Izenpe reported that it had issued a certificate containing an OU field longer than 64 characters. The certificate was issued at 11:52 on Feb 14 and was detected in the following minute, then revoked at 12:07. Izenpe said it identified the cause as a bug in the preventive filter of its PKI software, and that the issue was immediately detected by the post-issuance filters (cablint, x509lint, and zlint). After contacting the PKI software manufacturer, Izenpe reported that a hotfix was available and planned to apply it to production by March 3. In the bug thread, Izenpe stated it installed the hotfix in development and then applied the patch to the production environment, and also applied cablint, x509lint, and zlint in the development environment as a post-issuance filter. Izenpe further reported generating a full test case kit to validate patches and requesting the manufacturer to categorize patches/hotfixes, with additional internal timing requirements described earlier in the thread. The bug was marked RESOLVED with resolution FIXED, and a follow-up comment indicated remediation actions were complete.

1. 2019-02-14 Izenpe issued a certificate with an OU field longer than 64 characters and then revoked it shortly after detection.
2. 2019-02-15 Izenpe reported the misissuance and posted an incident report to the mozilla.dev.security.policy list and provided a CT/certificate reference.
3. 2019-03-04 Izenpe reported that the manufacturer hotfix/patch was applied to production and that planned remediation actions were completed.

1. 2019-02-15 Fastly representative — Wayne Thayer (Fastly) posted that Izenpe reported a misissuance involving a certificate with an OU > 64 characters and noted it was revoked minutes later, with an incident report to follow.
2. 2019-02-15 Fastly representative — Wayne Thayer included Izenpe’s incident report content describing detection/revocation timing, the preventive filter bug cause, and planned remediation including a hotfix by March 3.
3. 2019-02-19 Izenpe S.A. — Oscar Garcia stated Izenpe had installed the hotfix in development, would apply it to production before March 3, and would use dual manual checks meanwhile, along with improvement actions.
4. 2019-02-19 Fastly representative — Wayne Thayer asked Oscar to update the bug when the planned actions were completed.
5. 2019-02-26 Izenpe S.A. — Oscar Garcia reported that manufacturer patch categorization was requested and pending, and that applying linters in the development environment was still pending.
6. 2019-03-04 Izenpe S.A. — Oscar Garcia reported the patch was put into production and listed completed tasks: applying cablint/x509lint/zlint in development, generating a full test case kit, and requesting manufacturer patch categorization.
7. 2019-03-04 Fastly representative — Wayne Thayer commented that it appeared all remediation actions were complete.