NetLock intermediate certificates issued after 2019-01-01 without required EKU extension

This case concerns NetLock’s disclosure of three intermediate CA certificates issued after 2019-01-01 that did not comply with Mozilla Policy 2.6.1 because they lacked the required EKU extension. Ryan Sleevi opened the bug after a spot-check and listed the affected certificates on crt.sh. NetLock said it had identified the issue during an internal review on 2019-10-04, before the bug was filed, and that it had stopped issuing certificates with the problem. NetLock reported that it would replace the affected certificates, migrate end-entity certificates to new CAs, and add linting checks and process changes to prevent recurrence. The thread later records that the modified checking code went live on 2019-11-18, the affected CAs were replaced, and NetLock said the work was completed. Mozilla also discussed a separate delayed-revocation issue in the thread, but Ryan asked for that to be tracked in a separate bug.

1. 2019-04-02 First affected intermediate certificate was issued without the required EKU extension.
2. 2019-05-27 Last affected intermediate certificate was issued without the required EKU extension.
3. 2019-10-04 NetLock identified the non-compliant issuance during an internal review.
4. 2019-10-07 Mozilla filed the bug after discovering the issue in a spot-check.
5. 2019-11-18 NetLock said modified checking code went live to block the error.
6. 2020-11-13 NetLock said the affected CAs had been replaced and the work was completed.

1. 2019-10-07 Community commenter — Ryan reported that NetLock had issued three intermediates after 2019-01-01 without an EKU extension and requested an incident report.
2. 2019-10-08 Netlock — NetLock said it had identified the issue on 2019-10-04 during an ongoing audit, had opened internal JIRA tickets, and was replacing the certificates and migrating end-entity certificates.
3. 2019-10-08 Fastly representative — Wayne asked why NetLock had failed to meet its earlier commitment to comply with the Mozilla change.
4. 2019-10-09 Netlock — NetLock said the failure was due to human error and that it had added another CCADB contact person to improve its process.
5. 2019-10-19 Netlock — NetLock proposed additional x509lint checks to block invalid EKU combinations in intermediates.
6. 2019-11-11 Netlock — NetLock said the modified checking code would be in production on 2019-11-18.
7. 2020-05-20 Netlock — NetLock gave a status update saying it had issued new certificates, fixed issuer software, and scheduled revocation and migration steps.
8. 2020-06-03 Mozilla representative — Kathleen Wilson said the MKB SubCA 5 was ready to be added to OneCRL and confirmed the other two subCAs had been revoked.
9. 2020-07-02 Community commenter — Ryan asked NetLock to file a separate bug for delayed revocation and to redo the incident report with more detail on the original failure.
10. 2020-11-13 Netlock — NetLock said the remediation was completed and the affected CAs had been replaced.