FNMT: QC Statement that contains at least one of the ETSI ESI statements
The bug was opened after the reporter identified zlint error 1193 affecting 21 precertificates issued by AC Componentes Informáticos, stating that the QC Statement that contains at least one of the ETSI ESI statements also features the set of mandatory ETSI ESI QC statements. Fastly’s Ryan Sleevi asked FNMT to provide an incident report as described in Mozilla’s incident response guidance. FNMT (a**********n@fnmt.es) stated that on 28/03/2020 it took steps to stop issuing SSL certificates from AC Componentes Informaticos until it fully analyzed the issue, and it shared its understanding of which ETSI ESI QC statements it was including and why. Ryan Sleevi responded that the analysis appeared correct and that he believed the issue was a ZLint bug, and he filed a bug in ZLint. FNMT indicated it could resume issuing certificates, and later provided details of the certificate profile and the QC statements included. Ryan Sleevi confirmed that the certificates matched the stated profile and agreed that the use of these QC statements does not imply a Qualified certificate or a violation of the referenced ETSI requirements. The bug was resolved as INVALID.
- A reporter identified zlint error 1193 affecting 21 precertificates issued by AC Componentes Informáticos.
- FNMT temporarily stopped issuing SSL certificates from AC Componentes Informaticos while analyzing the issue.
- FNMT provided its analysis and certificate profile details; the reporter confirmed the certificates matched the profile and agreed no ETSI violation was implied.
- Lebihan representative — Reported finding 21 precertificates with zlint error 1193 and linked to crt.sh for the affected CAID.
- Fastly representative — Asked Angel to provide an incident report per Mozilla’s incident response instructions.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Stated FNMT stopped issuing SSL certificates from AC Componentes Informaticos on 28/03/2020 and explained its understanding of the QC statements included and the related ETSI context.
- Community commenter — Agreed the analysis seemed correct, believed it was a ZLint bug, and referenced a ZLint PR and a ZLint issue filed.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Indicated FNMT understood it could resume issuing certificates.
- Community commenter — Asked for clarification of certificate profiles and which QC statements were included, offering to re-check compliance.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Provided the AC Componentes certificate profile for OVCPs and listed the QC statements included.
- Community commenter — Confirmed the certificates matched the profile and agreed the QC statements do not imply a Qualified certificate or an ETSI violation.