PKIoverheid: Compliance issues with CIBG TLS certificates

This case concerns PKIoverheid (Logius) disclosing compliance issues found in TLS certificates issued by CIBG under the “Staat der Nederlanden Root CA – G2”. During a QA check on certificates provided by CIBG for Bug 1573490 (insufficient serial number entropy), Logius found multiple compliance issues and asked CIBG for clarification. Logius reported that CIBG stopped normal issuance of publicy trusted TLS certificates to third parties under that root in December 2017, with a few test certificates issued in March 2018 that were revoked. Logius stated that the affected certificates (3311) contained the forbidden “subject.altname.othername” field and were lacking the CA/Browser Forum Policy OID for OV certificates 2.23.140.1.2.2. Logius also described that it was not aware of the issue until information gathering for Bug 1573490, and it attributed the lack of earlier detection to CP administration and oversight, plus the fact that the certificates were mainly used for machine-to-machine communication and predated CT logging. The bug was published on Bugzilla on 2019-09-04, and the resolution was FIXED; a later comment stated that remediation was complete.

1. 2017-12-01 CIBG stopped normal issuance of publicly trusted TLS certificates to third parties under the “Staat der Nederlanden Root CA – G2” root.
2. 2018-03-01 A few test TLS certificates were issued under the root and were later revoked.
3. 2019-07-23 PKIoverheid (Logius) requested from CIBG a list of certificates in scope for the issue discussed in Bug 1573490.
4. 2019-08-28 Logius performed a QA check on the provided certificates and identified multiple compliance issues.
5. 2019-09-04 Logius published the issue on Bugzilla after determining a remediation approach, including revocation actions.

1. 2019-09-04 Logius representative — Opened the bug and described the compliance issues found in CIBG TLS certificates, including the forbidden subject.altname.othername field and missing OV Policy OID, along with the discovery timeline and planned remediation.
2. 2019-09-04 Community commenter — Asked questions to build a holistic view, including why the issues were not detected earlier by Logius controls or by BSI, and requested explanation of the delay between 2019-03-15 and 2019-08-13.
3. 2019-09-16 Logius representative — Provided detailed explanations for why the issues were not detected earlier, including CP changes, oversight, and BSI’s response, and stated that the delay was an oversight.
4. 2019-09-16 Community commenter — Acknowledged that the questions were answered and indicated follow-ups would be checked with Wayne.
5. 2019-09-16 Fastly representative — Stated that it appears all questions were answered and remediation is complete.