Camerfirma: Invalid authorityKeyIdentifier - recurrent incident

This case concerns Camerfirma certificates with an invalid authorityKeyIdentifier (AKI) that recurred. The CA said it first became aware of the problem when information was included in a prior bug (1586860#c15). After detecting the new errors, Camerfirma reported that it revoked two affected pre-certificates immediately (March 11) and stopped issuing certificates after receiving the communication, with the last certificate issued on March 10. The CA then examined the zlint version in use, investigated profiles to find those with errors, installed zlint 2.0.0, changed and tested the affected profiles, and resumed issuing certificates on March 16 after correcting the profiles. Camerfirma also described additional operational controls, including manual Zlint checks before issuing the first certificate of each kind of profile, revocation of all affected certificates by March 20, substitution of revoked certificates by March 20, and an added procedure to verify AKI before issuance (by April 1). The bug was resolved as a duplicate.

1. 2019-10-08 Camerfirma began development to change the affected certificate profiles.
2. 2019-10-25 Camerfirma passed the profile changes to the production environment.
3. 2020-03-10 Camerfirma issued its last certificate before stopping issuance after receiving the communication.
4. 2020-03-11 Camerfirma revoked two newly detected affected pre-certificates and began investigating the issue.
5. 2020-03-16 Camerfirma resumed issuing certificates after correcting the affected profiles.
6. 2020-03-20 Camerfirma completed revocation of all affected certificates and substitution of revoked certificates.
7. 2020-04-01 Camerfirma planned to add AKI verification to its issuance procedure.

1. 2020-03-18 AC Camerfirma, S.A. — Created the bug with a description of the recurrent invalid authorityKeyIdentifier issue, including actions taken (stopping issuance, revoking affected pre-certificates, updating zlint, changing/testing profiles, and resuming issuance).
2. 2020-03-18 AC Camerfirma, S.A. — Noted that this bug was marked as a duplicate of bug 1623384.