← GlobalSign nv-sa cases
Bugzilla #1690807
Certificate Misissuance
GlobalSign: RSA-1024 leaf certificate issued after 2013-12-31
RESOLVED
FIXED
GlobalSign nv-sa
AI Summary
GlobalSign issued a leaf certificate with an RSA-1024 key, which violates the Baseline Requirements established over seven years ago. The certificate was revoked shortly after being reported via Bugzilla. GlobalSign has committed to providing a detailed incident report and has initiated a review of their certificate issuance processes to prevent similar occurrences in the future. They have also enabled linting for their CA systems to ensure compliance with current standards.
Chronology
- Certificate with RSA-1024 key issued
- Bugzilla report received
- Certificate revoked
- Incident report provided
Participants
Rob Stradling
Eva Van Steenberge
Arvid Vermote
Ryan Sleevi
Brett Wilson
External References
Similar Local Cases
GlobalSign: Use of Domain Validation Random Value for more than 30 days
GlobalSign: Incorrect RegNumber-Org Type combination
GlobalSign: Wrong business category (Non Commercial Entity when should have been Private Organization)
GlobalSign: TLS OV Certificate containing unverified information
Dhimyotis / Certigna: Certificates issued with validity periods greater than 398-days
GlobalSign: Issuance of test certificate (pre-certificate) for EV SSL/QWAC with no EKU extension
SECOM: Mis-issued EV Certificates
NetLock: Issuance of >398-day precertificates after 2020-09-01