Microsoft PKI Services: Underscore in SAN

This case involves Microsoft PKI Services disclosing a compliance issue regarding two certificates that contained underscores in the Subject Alternative Name (SAN), which is not permitted under CA/B Forum guidelines. The issue was first reported by DigiCert on April 15, 2021. Microsoft promptly halted issuance of all new certificates and initiated an internal investigation. They revoked the identified certificates and implemented updates to their internal linting tools to prevent future occurrences. As of July 2021, Microsoft completed all remediation actions, including a full inventory of their linting controls, and confirmed no additional certificates with this issue were found.

1. 2021-04-15 Microsoft PKI Services was notified of a compliance issue regarding underscores in SAN.
2. 2021-04-15 Microsoft halted issuance of certificates and began an internal investigation.
3. 2021-04-15 Two certificates were revoked due to the compliance issue.
4. 2021-07-29 Microsoft completed a full inventory of their linting controls and confirmed no significant gaps.

1. 2021-04-15 Lebihan representative — Reported two certificates containing underscores in the SAN.
2. 2021-04-15 Microsoft Corporation — Provided a timeline of actions taken in response to the issue.
3. 2021-07-02 Microsoft Corporation — Updated on the progress of remediation actions and timelines.
4. 2021-09-16 Microsoft Corporation — Requested closure of the bug after completing all remediation actions.