Camerfirma: Invalid authorityKeyIdentifier, violating Mozilla Policy and RFC 5280

Camerfirma discovered that it had issued approximately 3233 certificates with an invalid Authority Key Identifier, violating both Mozilla Policy and RFC 5280. The issue was identified during an evaluation of linting tools, prompting the CA to proactively disclose the misissuance to Mozilla. In response, Camerfirma developed an action plan to rectify the issue, which included ensuring that all new certificates would only include the key identifier in the Authority Key Identifier field. By October 29, 2019, all website certificates were updated accordingly, and S/MIME certificates were set to be updated by November 20, 2019. The bug was resolved with the implementation of these changes.

1. 2019-10-07 Camerfirma discovers misinterpretation of Authority Key Identifier and reports to Mozilla.
2. 2019-10-29 Camerfirma confirms all website certificates now comply with the correct Authority Key Identifier.
3. 2019-11-18 Camerfirma updates all S/MIME certificates to comply with the correct Authority Key Identifier.

1. 2019-10-07 Community commenter — Reported that Camerfirma issued certificates violating RFC 5280 and Mozilla Policy.
2. 2019-10-11 AC Camerfirma, S.A. — Camerfirma acknowledges the issue and outlines an action plan to resolve it.
3. 2019-10-25 AC Camerfirma, S.A. — Camerfirma confirms that changes to the Authority Key Identifier will be deployed soon.
4. 2019-11-18 AC Camerfirma, S.A. — Camerfirma states that all new S/MIME certificates now include the correct Authority Key Identifier.