← MULTICERT cases
Bugzilla #1532333
Certificate Problem Report
Camerfirma: Unrevocation of MULTICERT SSL Certification Authority 001 certificate
RESOLVED
FIXED
MULTICERT
AI Summary
Camerfirma faced a significant incident involving the unrevocation of the MULTICERT SSL Certification Authority 001 certificate due to a misissued Certificate Revocation List (CRL). The issue arose from human error, where a CRL was published with an incorrect serial number, leading to confusion between two similar CA certificates. This incident raised serious concerns about the immutability of revocations and the entropy of serial numbers. Camerfirma has since implemented measures to improve their processes, including enhanced controls for certificate issuance and CRL publication to prevent such occurrences in the future.
Chronology
- MULTICERT reported revocation alerts for the CA certificate.
- Camerfirma improved CRL publishing procedures.
- EJBCA pre-production environment deployment completed.
- EJBCA production environment deployment completed.
- Camerfirma deployed an internal tool to manage CA certificates.
Participants
Eusebio Herrera
Ryan Sleevi
Juan Angel Martin
Wayne Thayer
Ana Lopes
External References
Similar Local Cases
Camerfirma: Unrevocation of MULTICERT SSL Certification Authority 001 certificate
Camerfirma: MULTICERT certificates with a validity period greater than 825 days
Camerfirma: Invalid authorityKeyIdentifier - recurrent incident
Camerfirma: certificate for unregistered domain cuatis.net
Camerfirma: suspicious certificate for com.com
Camerfirma: Invalid stateOrProvinceName field
Camerfirma: MULTICERT certificates with a validity period greater than 825 days
Camerfirma: Incorrect OCSP Delegated Responder Certificate