← Buypass cases
Bugzilla #1626078
Certificate Misissuance
Self Reported Incident
Buypass: Missing NCA identifier in cabfOrganizationIdentifier in PSD2 QWACs
RESOLVED
FIXED
Buypass
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Buypass identified an issue with the cabfOrganizationIdentifier extension in their PSD2 Qualified Website Authentication Certificates (QWACs), where the NCA identifier was missing. This was reported to them by members of the PSD2 community on March 26, 2020. Upon investigation, Buypass acknowledged the issue and ceased issuance of the affected certificates. They implemented a fix and subsequently revoked all 16 affected certificates by April 4, 2020. The incident was documented and shared with the web PKI community as part of their proactive disclosure.
Chronology
- Buypass became aware of the missing NCA identifier in cabfOrganizationIdentifier extension.
- All affected certificates were revoked.
Thread Activity
- Buypass — Created an incident report regarding the missing NCA identifier.
- Buypass — Confirmed decision to revoke all affected certificates.
- Buypass — Reported that all affected certificates have been revoked.
Participants
Buypass
Community commenter
Fastly representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Buypass: Insufficient Serial Number Entropy
Buypass: Illegal Business Category in a PSD2 QWAC
CFCA: Wrong SerialNumber encoding
GlobalSign: 4 Misissued certificates with invalid CN
GDCA: Misissuance of certificates with small RSA keys
Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #1 - Compliance auditing on support processes
Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #2 - Supply chain policy
Buypass: Using an external DNS Resolver for DNS lookups