E-Tugra: commonName not in SAN

RESOLVED FIXED e-tugra

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

E-Tugra disclosed a compliance issue regarding a certificate that was issued with a commonName not included in the Subject Alternative Name (SAN) extension. The issue was first reported by an external party on January 15, 2021, leading to the creation of this bug. E-Tugra took immediate action by reissuing the certificate and marking the original for revocation. A preliminary report was submitted detailing the timeline of events and the CA's response. The CA has since implemented enhanced validation controls to prevent similar issues in the future. The bug has been resolved with the necessary updates made to their processes.

Model: gpt-4o-mini Generated: 2026-06-13 21:21 UTC Revised: 2026-06-16 18:35 UTC Confidence: 0.90 20 comments

Chronology

2020-12-23 The problematic certificate was issued.
2020-12-24 The problem with the certificate was identified, and a new certificate was issued.
2021-01-15 An external report was received regarding the commonName issue.
2021-01-18 E-Tugra's Security Group investigated the problem and revoked the certificate.
2021-04-03 E-Tugra implemented updated validation controls in production.

Thread Activity

2021-01-16 Fozzie representative — Reported the issue regarding the commonName not in SAN.
2021-01-18 E-Tugra — Submitted a preliminary report outlining the timeline and actions taken.
2021-01-19 Fozzie representative — Requested separate bugs for additional issues identified.
2021-03-31 E-Tugra — Provided an update on the completion of validation control implementations.
2021-04-02 Mozilla representative — Indicated intent to close the bug unless further discussion is needed.

Participants

Fozzie representative E-Tugra Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#1801345 RESOLVED Self Reported Incident Security Incident Opened 2022-11-18 · Closed 2023-07-21 · 86% similar

E-Tugra: Incident Report (Security Issues)

AI Summary CA Owner

#1542302 RESOLVED Self Reported Incident Opened 2019-04-05 · Closed 2023-02-22 · 84% similar

E-Tugra: Insufficient serial number entropy

AI Summary CA Owner

#1649277 RESOLVED Self Reported Incident Incident Opened 2020-06-29 · Closed 2023-02-22 · 78% similar

DigiCert: Failure to provide a preliminary report within 24 hours.

AI Summary CA Owner

#1582601 RESOLVED Self Reported Incident Certificate Misissuance Opened 2019-09-20 · Closed 2023-02-22 · 78% similar

E-Tugra: Invalid DER results in failure to comply with RFC 5280 - Violating string length limit

AI Summary CA Owner

#1671113 RESOLVED Self Reported Incident Opened 2020-10-14 · Closed 2023-02-22 · 77% similar

SwissSign: Failure to provide a preliminary report within 24 hours.

AI Summary CA Owner

#1667684 RESOLVED Self Reported Incident Opened 2020-09-27 · Closed 2023-02-22 · 77% similar

Asseco DS / Certum: Failure to provide a preliminary report within 24 hours.

AI Summary CA Owner

#1708834 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-04-30 · Closed 2023-02-22 · 76% similar

GlobalSign: Invalid stateOrProvinceName and locality pair

AI Summary CA Owner

#1709392 RESOLVED Self Reported Incident Certificate Misissuance Opened 2021-05-04 · Closed 2023-02-22 · 76% similar

Asseco DS / Certum: Invalid stateOrProvinceName field (recurrent incident)

AI Summary CA Owner