Microsoft PKI Services: Certificate Mis-Issuance, DNSNames must have a valid TLD

Microsoft PKI Services experienced a certificate mis-issuance incident where certificates were issued for a domain that did not have a valid top-level domain (TLD). The issue was identified after a partner notified Microsoft on October 8, 2020. Following the notification, Microsoft took immediate action, including revoking the mis-issued certificates and improving their domain validation processes. The root cause was linked to a domain that was mistakenly added to their system, which was not public. Microsoft has since implemented measures to prevent similar incidents in the future, including enhanced checks and automation in their domain validation process.

1. 2020-10-08 Microsoft was notified by a partner about the mis-issued certificates.
2. 2020-10-09 Microsoft created an internal incident and began managing the issue.
3. 2020-10-09 The problematic domain was removed from the production system.
4. 2020-10-09 Certificates issued to the domain were revoked.
5. 2021-05-28 Microsoft confirmed the removal of the DNS Operator exception from their CPS.