← Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM) cases
Bugzilla #1551369
Certificate Misissuance
Kamu SM: "Some-State" in stateOrProvinceName
RESOLVED
FIXED
Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)
AI Summary
The Government of Turkey's Kamu Sertifikasyon Merkezi (Kamu SM) issued two certificates containing the invalid stateOrProvinceName "Some-State" due to a failure in validating the CSR fields. This issue was identified through a notification from the Mozilla community, leading to an investigation that confirmed only the two certificates were affected. Kamu SM has since implemented controls in their ARMA system to prevent such misissuances in the future, including the addition of validation for the state and locality fields. The problematic certificates have been revoked, and remediation measures are now in place.
Chronology
- Kamu SM became aware of the issue via a notification.
- Revocation of the two problematic certificates was completed.
- Controls on the CSR subject field were added to the ARMA program.
- All questions were answered and remediation was confirmed complete.
Participants
Wayne Thayer
Melis Şimşek
Ryan Sleevi
Erhan Turan
External References
Similar Local Cases
E-Tugra: Invalid DER results in failure to comply with RFC 5280 - Violating string length limit
SECOM: "Default City" in Subject:localityName
Hongkong Post / Certizen: Failure to report misissuance
DigiCert: "Some-State" in stateOrProvinceName
SwissSign: Invalid DNSName in SAN
NetLock: CN not in SAN
SECOM: Failure to disclose Unconstrained Intermediate within 7 Days
certSIGN: "Some-State" in stateOrProvinceName