← Buypass cases
Bugzilla #1654216
Certificate Problem Report
Buypass: PSD2 QWAC with RSA modulus not divisible by 8
RESOLVED
FIXED
Buypass
AI Summary
Buypass reported an incident involving a PSD2 Qualified Website Authentication Certificate (QWAC) that had an RSA modulus not divisible by 8. The issue was first identified on July 17, 2020, when Digicert notified Buypass. In response, Buypass temporarily halted the issuance of manually issued certificates and conducted an analysis of their active certificates, finding no other affected instances. The problematic certificate was revoked on July 20, 2020, and Buypass implemented additional controls to prevent future occurrences. The incident was resolved with no further certificates issued with the same issue.
Chronology
- Digicert notified Buypass about the problem.
- The affected certificate was revoked.
Participants
Mads Henriksveen
Ben Wilson
Ryan Sleevi
External References
Similar Local Cases
Buypass: Illegal Business Category in a PSD2 QWAC
Buypass: Failure to revoke PSD2 QWACs within mandated 5 days
Buypass: Missing NCA identifier in cabfOrganizationIdentifier in PSD2 QWACs
Buypass: Intermediate certificates not listed in audit reports
Buypass: intermediate certificates not revoked within BR time period
Buypass: Domain validation method using not allowed domain contact
Buypass: TLS certificates with incorrect Subject attribute order
Buypass: Insufficient Serial Number Entropy