Amazon Trust Services: Revoked Sample Certs Missing SANs

Amazon Trust Services issued “Sample Certificates” intended for application software suppliers to test revoked certificates, and each issued certificate was immediately revoked. During a regular certificate review on August 6, 2019, the CA discovered that 3 of the sample certificates were missing their Subject Alternative Names (SANs). The CA stated the root cause was a transcription error when creating the first subject information template, which resulted in SANs not being included in the template before it was committed to source control. The CA said it had stopped issuing certificates missing SANs. To remediate, the CA corrected the template, moved the certificate issuance checklist into a tool that tracks and enforces each step, and stated that test output would be verified by two people not directly involved with the ceremony. The bug was resolved as FIXED, and a later comment indicated remediation was complete.

1. 2019-07-30 Sample certificates were issued and immediately revoked as part of the standard process.
2. 2019-08-06 During regular certificate review, the CA discovered 3 sample certificates were missing SANs.
3. 2019-08-12 The CA fixed, peer reviewed, and committed the corrected subject template.
4. 2019-08-16 The CA moved the certificate issuance checklist into an enforcing tool.

1. 2019-08-16 DigiCert — Reported that 3 revoked sample certificates lacked SANs due to a transcription error in a subject template, and described remediation steps including stopping further issuance, correcting the template, and enforcing checklist steps via a tool.
2. 2019-09-05 DigiCert — Asked whether there were any questions or feedback and noted there were no pending actions.
3. 2019-09-05 Community commenter — Commented about whether a flag (NI) was meant to be cleared and suggested resetting it.
4. 2019-09-05 Fastly representative — Stated it appeared all questions were answered and remediation was complete.