← GlobalSign nv-sa cases
Bugzilla #1547691
Certificate Misissuance
GlobalSign: AT&T SSL certificates without the AIA extension
RESOLVED
FIXED
GlobalSign nv-sa
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
GlobalSign reported a compliance issue involving AT&T SSL certificates that lacked the required AIA extension. The issue was discovered during routine communications, leading to a conference call where AT&T acknowledged the misconfiguration due to a recent EJBCA upgrade. GlobalSign is working with AT&T to gather details on the affected certificates and establish a remediation plan, which includes replacing and revoking the misissued certificates. As of August 30, 2019, GlobalSign confirmed the revocation of the two active CAs associated with AT&T, completing the remediation process.
Chronology
- Discovery of SSL certificates without the AIA extension.
- GlobalSign revoked the two active CAs associated with AT&T.
Thread Activity
- Community commenter — Reported the issue regarding AT&T SSL certificates missing the AIA extension.
- Community commenter — Provided an incident report detailing the misissued certificates.
- Community commenter — Confirmed the revocation of AT&T's CAs.
- Fastly representative — Noted that all questions have been answered and remediation is complete.
Participants
Community commenter
Fastly representative
External References
Similar Local Cases
GlobalSign: IP in dnsName
GlobalSign: 4 Misissued certificates with invalid CN
GlobalSign: AT&T Insufficient Serial Number Entropy
GlobalSign: Wrong business category (Non Commercial Entity when should have been Private Organization)
GlobalSign: Invalid stateOrProvinceName and locality pair
GlobalSign: Invalid countryName
GlobalSign: S/MIME Sponsor validated certificates with CommonName value equal to OrganizationName
GlobalSign: Remove EV bit from ex-GS roots now owned by GTS