CFCA: Wrong OrganizationName

This case reports that China Financial Certification Authority (CFCA) issued two wrong certificates for testing purposes with an incorrect OrganizationName. The issue was triggered during a test mission that included certificate application, revocation, and update, when a test engineer inadvertently issued the two error certificates. CFCA states that both certificates were revoked quickly: one was revoked by the test engineer and the other was revoked about one hour later after an auditor noticed the problem, with the overall process taking less than two hours. CFCA also reports follow-up actions including restricting the test engineer’s permissions to the minimum scope and planning to add professional auditors and training for future testing. In response to Mozilla’s questions, CFCA stated it reviewed user permissions and testing procedures, and it planned additional technical restrictions (such as preventing multiple different roles from logging in from the same IP) and involving product and compliance managers in review. The bug was marked RESOLVED with resolution FIXED, and a later comment indicated remediation was complete.

1. 2020-01-09 CFCA’s test engineer inadvertently issued two test certificates with the wrong OrganizationName, which were later revoked the same day.
2. 2020-01-10 CFCA reported the incident in the Mozilla CA Program bug and described remediation steps.
3. 2020-01-17 A participant stated that all questions were answered and remediation was complete.

1. 2020-01-10 Community commenter — Created the report describing two wrong OrganizationName certificates issued during testing, noting they were revoked quickly and that test engineer permissions were restricted afterward.
2. 2020-01-10 Community commenter — Asked for further details on root cause analysis and follow-up, including permission review, ensuring testing procedures are followed, monitoring for revocation events, and clarification of the planned auditor training.
3. 2020-01-13 Community commenter — Provided responses to the follow-up questions, stating permissions and testing procedures were reviewed and describing planned technical restrictions and increased involvement/training of professional auditors.
4. 2020-01-17 Fastly representative — Stated that it appears all questions were answered and remediation is complete.