Chunghwa Telecom incident report for two test certificates with unregistered domain names

Chunghwa Telecom reported that it found two mis-issued test certificates containing unregistered FQDNs during an internal review of certificates in crt.sh. The first certificate was revoked shortly after discovery, and issuance was suspended while the CA performed an initial investigation. Chunghwa Telecom said the issue was caused by human error in the RAO process, and it introduced additional controls including two-stage manual verification and automated FQDN checking. The CA later said it implemented further automated validation methods for domain checks and updated Mozilla regularly on deployment progress. The bug was ultimately resolved as FIXED.

1. 2018-11-12 First problematic certificate was issued with an unregistered FQDN.
2. 2019-01-29 Second problematic certificate was issued with an unregistered FQDN.
3. 2019-02-15 Chunghwa Telecom discovered the mis-issued certificates, revoked one, and suspended issuance during investigation.
4. 2019-03-15 Automatic FQDN checking was implemented and enforced in Public CA.
5. 2020-02-18 Automatic domain-name validation functionality was reported as going live.
6. 2020-06-24 3.2.2.4.2 was reported as having gone live.

1. 2019-03-04 Fastly representative — Wayne Thayer opened the bug with Chunghwa Telecom's incident report describing two mis-issued certificates with unregistered domain names.
2. 2019-03-30 Cht representative — Chunghwa Telecom said automatic FQDN checking had been implemented and enforced on March 15.
3. 2019-05-31 Cht representative — Chunghwa Telecom said it had implemented a scheduling program to scan issued certificates and had revoked certificates with inaccurate FQDNs caused by domain ownership changes.
4. 2019-06-29 Fastly representative — Wayne Thayer asked how the RAO could issue the certificates without domain control validation and whether both domain existence and control could be checked automatically.
5. 2019-07-13 Cht representative — Chunghwa Telecom said the two mis-issued certificates were OV certificates and that it had asked its vendor to add BR validation methods for authority checks.
6. 2020-01-23 Cht representative — Chunghwa Telecom said its vendor would add additional validation methods and estimated the automatic domain-name check would go live around February 18, 2020.
7. 2020-02-05 Cht representative — Chunghwa Telecom apologized for not replying regularly and promised weekly updates.
8. 2020-03-25 Cht representative — Chunghwa Telecom said the changes had gone live and explained that WHOIS protocol decoding issues affected Chinese company names.
9. 2020-05-26 Cht representative — Chunghwa Telecom said it supported several validation methods, with 3.2.2.4.2 still under development, and planned additional methods 3.2.2.4.13 and 3.2.2.4.14.
10. 2020-06-24 Cht representative — Chunghwa Telecom said 3.2.2.4.2 had gone live.
11. 2020-07-03 Cht representative — Chunghwa Telecom summarized the incident, said it had informed the auditor, and stated that the issuance of unregistered FQDNs could no longer occur.