KIR S.A.: Invalid localityName + CRL Revoked but OCSP Unknown

Krajowa Izba Rozliczeniowa S.A. (KIR) identified a compliance issue involving a certificate with an incorrect `localityName` value, which was revoked in the Certificate Revocation List (CRL) but initially returned an unknown status in the Online Certificate Status Protocol (OCSP). KIR discovered the typo during an internal self-audit and was also alerted by a third-party report. Following the incident, KIR implemented several corrective actions, including requiring dual operator verification for all certificate requests and enhancing validation processes against official databases. The issue has been resolved, and KIR has committed to ongoing reviews of both active and historically issued certificates to prevent similar occurrences.

1. 2020-06-01 Certificate was issued and immediately revoked.
2. 2021-04-15 KIR reported the incident regarding the invalid localityName.
3. 2021-05-06 KIR implemented two-person validation for certificate requests.
4. 2021-06-09 KIR completed a scan of its historic issuance.

1. 2021-04-15 Lebihan representative — Reported a typo in the localityName of a certificate.
2. 2021-04-15 Kir representative — Confirmed that the OCSP status was updated to revoked.
3. 2021-05-05 Kir representative — Announced deployment of technical changes to sync OCSP/CRL.
4. 2021-06-09 Kir representative — Completed a scan of historic certificates and found additional typos.