← Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) cases
Bugzilla #1693304
Validation Issue
FNMT: Issuance of QCP-n certificates without verifying identity
RESOLVED
FIXED
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The Government of Spain's Fábrica Nacional de Moneda y Timbre (FNMT) reported an incident regarding the issuance of QCP-n certificates without proper identity verification. This issue was discovered during an annual audit on February 4, 2021, which revealed that the process did not guarantee compliance with Spanish law regarding the maximum time elapsed since physical identification. FNMT suspended the issuance of these certificates and informed the relevant authorities. A total of 139 certificates were revoked due to this compliance issue. The CA has since clarified its procedures to ensure adherence to both the Baseline Requirements and Spanish law.
Chronology
- FNMT discovered potential non-compliance during an annual audit.
- FNMT disclosed the incident to Mozilla.
- FNMT clarified the procedures and compliance measures taken.
- Bug scheduled for closure by Mozilla.
Thread Activity
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT reported an incident related to the issuance of QCP-n certificates.
- Community commenter — Questioned the timing of the report and compliance verification.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Clarified the compliance measures and the nature of the incident.
- Mozilla representative — Scheduled the bug for closure unless further issues arise.
Participants
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
Community commenter
Mozilla representative
External References
Similar Local Cases
Multicert: AIA CA Issuer field pointing to PEM encoded cert
GlobalSign: SSL Certificates with US country code and invalid State/Prov
Google Trust Services: Failure to properly validate IP address
GlobalSign: Organization-validated SMIME certificate with invalid organizationIdentifier for European country
SSL.com: Insufficient validation evidence for the localityName attribute of an OV certificate
eMudhra emSign PKI Services : OCSP Responder Time Inconsistency
Sectigo: Inadequate DCV
Let's Encrypt: 2019.08.20 Incident: Incorrect OCSP responses under certain conditions