← Microsoft Corporation cases
Bugzilla #1598390
Ca Certificate Compliance
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsoft PKI Services reported a null character issue in certificates caused by a bug in Windows Server 2012 R2 Certificate Services. The problem was discovered during x509lint tests, and Microsoft proactively disclosed it to Mozilla. Although the issue was deemed cosmetic and did not impact certificate functionality, Microsoft ceased issuing new certificates with the problem and committed to using updated server versions. They have since reissued the affected root certificates and implemented additional linting steps in their CA processes to prevent future occurrences. The bug has been resolved, and the reissued certificates are now compliant.
Chronology
- Microsoft PKI Services opened an incident report regarding the null character issue.
- Microsoft revoked the affected certificates.
- Microsoft confirmed the completion of remediation steps.
Thread Activity
- Microsoft Corporation — Microsoft reported a null character issue in certificates and outlined their findings.
- Mozilla representative — Kathleen emphasized the CA's responsibility to review all certificates in their hierarchies.
- Microsoft Corporation — Julio confirmed that updates regarding the new replacement roots were added to relevant bugs.
Participants
Microsoft Corporation
Mozilla representative
Community commenter
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Microsoft DSRE PKI: problem reporting e-mail in CPS does not work
Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)
Microsoft PKI Services: Loss of Archived Firewall logs from Retention Store
Microsoft PKI Services: Subscriber certificate change made that was not compliant with CPS
Microsoft PKI Services: Pre-Sign Linting Validation did not occur in ICA creation
Disig: Non-BR-Compliant Certificate Issuance
Microsoft PKI Services: Improper Disclosure of CRLs – Protocol Scheme
Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject