Telekom Security: Key Encipherment in two ECC SAN TLS certificates

Deutsche Telekom Security GmbH reported the issuance of two ECC SAN TLS certificates with an incorrect Key Usage of 'Key Encipherment'. The CA discovered the issue during a quality assurance check and revoked the certificates within 24 hours. An incident report was promised following the initial investigation. The root cause was identified as an incorrectly configured template that led to the issuance of the erroneous certificates. The CA has since implemented changes to prevent similar issues, including improvements to their linting processes and template management.

1. 2021-04-06 Two ECC SAN TLS certificates were issued with incorrect Key Usage.
2. 2021-04-07 The erroneous certificates were revoked.

1. 2021-04-07 Telekom representative — Two ECC SAN TLS certificates were issued with Key Usage 'Key Encipherment'. The certificates were revoked within 24 hours.
2. 2021-04-13 Telekom representative — An incorrect template was referenced, resulting in the issuance of two incorrect ECC SAN TLS certificates.
3. 2021-04-21 Community commenter — Request for more details on the change and testing performed.
4. 2021-05-12 Telekom representative — The CA software update to centralize the configuration of linters has been deployed.
5. 2021-06-08 Telekom representative — The CA software update has been deployed to the remaining CA instance.