FNMT: Misissuance of web site certificates missing CA/Browser Forum reserved policy OIDs
FNMT reported that it discovered a compliance issue in which required CA/Browser Forum reserved policy OIDs were missing from certain certificate types. The issue was identified on March 8, 2021 at 9:50am after FNMT reviewed forum discussions and CA Compliance bugs. FNMT stated it suspended issuance for the affected certificate types at 10:00am and began identifying affected certificates and notifying subscribers about the need to revoke and reissue certificates. FNMT provided an incident report describing the cause, including that monitoring for the applicable Baseline Requirements version and actuation on ballot SC31 was not carried out due to diminished compliance team activity, and that pre-issuance linting and hourly crt.sh-based post-issuance tests did not identify the incident. FNMT updated certificate profiles and reactivated issuance at 11:10am after successful profile updates. FNMT later stated that all affected certificates were revoked, with the last certificate revoked at 2021-03-13 08:45:11 UTC, and Mozilla indicated the bug would be closed on or about March 26, 2021 unless other issues remained. The bug is marked RESOLVED with resolution FIXED.
- FNMT noted a requirement that subscriber certificates must include a CA/Browser Forum Reserved Policy Identifier in the Certificate Policies extension.
- FNMT identified missing CA/Browser Forum reserved policy OIDs in certain certificate types and suspended issuance.
- FNMT completed revocation of all affected certificates.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT reported that required CA/Browser Forum reserved policy OIDs were missing from specific EVCP/OVCP certificate types, suspended issuance, and said it would provide a complete incident report.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT provided a detailed incident report timeline, affected-certificate counts and issuance date ranges, and described steps including subscriber notification and certificate profile updates.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT completed the incident report with an explanation of causes and remediation steps, including a new compliance surveillance protocol and additional technical controls.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT stated that all affected certificates had been revoked, with the last certificate revoked at 2021-03-13 08:45:11 UTC.
- Mozilla representative — Mozilla said it would schedule the bug to be closed on or about 26-Mar-2021 unless other issues or questions needed resolution.