← Microsoft Corporation cases
Bugzilla #1674561
Certificate Misissuance
Microsoft PKI Services: DV certificate issued with OV fields
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Microsoft PKI Services, which issued a Domain Validated (DV) certificate containing Organization Validation (OV) fields. The issue was first reported by a user on October 31, 2020, leading to an internal investigation by Microsoft. They confirmed the misissuance was due to a failure in the logic of a seldom-used workflow. Microsoft took immediate action by revoking the affected certificates and implementing manual checks to prevent future occurrences. The CA has since automated checks to ensure compliance and is actively working on enhancing their pre-issuance linting processes. The case has been resolved with the implementation of these corrective measures.
Chronology
- Issue reported regarding misissued DV certificate with OV fields.
- All impacted certificates were revoked.
- Microsoft implemented ZLint for pre-issuance checking.
Thread Activity
- Fozzie representative — Reported a DV certificate issued with OV fields.
- Disabled representative — Confirmed the issue and initiated an internal investigation.
- Disabled representative — Notified that all impacted certificates were revoked.
- Disabled representative — Announced the implementation of ZLint for pre-issuance checks.
Participants
Fozzie representative
Disabled representative
Community commenter
Mozilla representative
External References
Similar Local Cases
Microsoft PKI Services: Underscore in SAN
Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)
Microsoft PKI Services: CA Certificates not published in DER Encoded Format
certSIGN: misissued an OV SSL certificate with no organizationName and localityName, instead of a DV SSL as requested by client
GlobalSign: Invalid stateOrProvinceName and locality pair
Asseco DS / Certum: Incorrect localityName
Izenpe: certificate issued to internal domain
Asseco DS / Certum: Invalid stateOrProvinceName field (recurrent incident)