Asseco DS / Certum: Use of forbidden subjectPublicKeyInfo algorithm

Asseco Data Systems S.A. was found to be issuing certificates that included the forbidden P-521 algorithm, violating Mozilla's Root Store Policy. The issue was reported in a Bugzilla case, prompting the CA to cease issuance of such certificates and to provide an incident report detailing the timeline and corrective actions taken. The CA has since implemented measures to ensure compliance with browser policies and has established a process for monitoring changes in requirements to prevent future occurrences.

1. 2019-01-08 Bugzilla case created regarding the use of forbidden algorithm.
2. 2019-01-09 CA blocked issuance of certificates with P-521 keys.
3. 2019-02-04 CA completed documentation comparing technical requirements from browser policies.