NetLock: Issuance of >398-day precertificates after 2020-09-01

This case concerns NetLock issuing two precertificates with a notBefore date of 28 September 2020 that were valid for 2 years (730 days), despite a rule effective after 2020-09-01 limiting validation to no more than 398 days. The issue was identified in the context of EV validation, where Mozilla asked for possible problems and NetLock reported remaining problems as an incident in a separate bug. NetLock stated that in its DV system the 2-year (730-day) certificate configuration was set to 365 days, but one certificate request in progress (quintessenz.hu) kept the 2-year configuration value for the CT certificate. NetLock reported that on 2020-09-29 it disabled issuance of SSL certificates with more than 398 days from the PROD environment and stated it is not issuing certificates with these problems anymore. NetLock also said it added new test cases and technical controls to make repeating the error impossible, including wiring the same checks for CT certificates as for standard SSL certificates during a system upgrade on 29-09-2020. Mozilla indicated the matter could be closed and scheduled it for 7-Apr-2021; the bug is marked RESOLVED with resolution FIXED.

1. 2020-09-28 Two precertificates were issued with notBefore 28 September 2020 and validity for 2 years (730 days).
2. 2020-09-29 NetLock disabled issuance of SSL certificates with validation longer than 398 days from the PROD environment and upgraded the system to apply the same checks to CT certificates.

1. 2020-11-10 Sectigo — Rob Stradling described two precertificates (crt.sh IDs) and argued they should be treated as misissuance of the corresponding final certificates under RFC 6962 section 3.1.
2. 2020-11-11 Netlock — Varga Viktor provided a timeline explaining how a certificate request in progress kept the 2-year CT configuration, and stated that issuance with >398-day validation was disabled in PROD on 2020-09-29 along with remediation via new tests and controls.
3. 2021-01-05 Community commenter — Ryan Sleevi asked for more specificity about the test cases and how NetLock prevents the risk when requests are in progress.
4. 2021-01-08 Netlock — Varga Viktor clarified that the original test scenario lacked validation for an ongoing order, and stated that CT certificates are treated as SSL certificates with the same blocking code and tests (including x509lint and lifespan checks).
5. 2021-04-02 Mozilla representative — Ben Wilson said he believed the matter could be closed and scheduled it for 7-Apr-2021.