HARICA: wrong characters in NC extension of Technically Constrained Intermediate CA Certificates

HARICA reported that, during a subCA creation ceremony on 2019-03-06, two Technically Constrained CA certificates were issued with a name constraints extension containing non-UTF-8 characters. HARICA became aware of the problem during post-creation quality verification, initiated an investigation, and determined there were no indications of misconfiguration. After detection, the CA certificates were never enabled in the CA platform and were revoked on the next day. HARICA also planned and performed a new ceremony, and stated it was able to reproduce the problem in a test environment, identify the cause, and issue the CA certificates correctly. The incident report was approved by management and published to Bugzilla on 2019-03-15, and HARICA updated ceremony instructions to prevent recurrence by adding a notice not to deviate from the standard script and by adding a step to verify console locale settings. A later comment stated that remediation had been completed, and the bug is marked RESOLVED with resolution FIXED.

1. 2019-03-06 During a subCA creation ceremony, two Technically Constrained CA certificates were issued with non-UTF-8 characters in the name constraints (NC) extension.
2. 2019-03-07 The problematic subCAs were revoked and a new ceremony was planned.
3. 2019-03-15 HARICA’s incident report was approved by management and published to Bugzilla.

1. 2019-03-15 HARICA — Filed an incident report describing how HARICA discovered non-UTF-8 characters in the NC extension after post-creation verification, revoked the certificates the next day, reproduced the issue in test, identified the cause (a LANG typo), and updated ceremony instructions to prevent recurrence; included certificate links and stated the incident had no impact.
2. 2019-04-19 Fastly representative — Commented that it appears remediation has been completed.