← HARICA cases
Bugzilla #1535772
Certificate Problem Report
HARICA: wrong characters in NC extension of Technically Constrained Intermediate CA Certificates
RESOLVED
FIXED
HARICA
AI Summary
HARICA identified an issue with two Technically Constrained CA certificates that contained non UTF-8 characters in the name constraints extension. This problem was discovered during a post-creation quality verification after the certificates were issued on March 6, 2019. An investigation revealed that a typo in the locale settings during the issuance ceremony led to the improper characters. The certificates were revoked the following day, and an incident report was published detailing the findings and corrective actions taken. HARICA has since updated their ceremony instructions to prevent recurrence of such issues.
Chronology
- Two subCAs issued with improper characters in name constraints extension.
- The two subCAs were revoked.
- Incident report published to Bugzilla.
Participants
Dimitris Zacharopoulos
External References
Similar Local Cases
HARICA: S/MIME certificate issuance without proper validation
HARICA: Certificates with invalid policy tree
HARICA: One of the two Certificate Problem Report email aliases not working
HARICA: Anomaly in OCSP services after CA software upgrade
HARICA: OCSP Responder Returned "Unauthorized" for Some Precertificates
HARICA: Incorrect OCSP Delegated Responder Certificate
HARICA: Insufficient serial number entropy
HARICA: Incorrect nCAId in PSD2 QCStatement for QWACs