KIR S.A.: Invalid organizationName in two certificates
This case concerns two KIR S.A. certificates that had an incorrect organizationName value of "Bank Testowy" instead of "Krajowa Izba Rozliczeniowa S.A." The issue was first reported by an external party, Michel Le Bihan, who provided crt.sh links for the affected certificates. KIR said one certificate was already revoked and that the other would be revoked the next day, then later reported that the remaining certificate was revoked on 2021-04-21. KIR also filed an incident report describing the cause as a single-operator review failure for internal orders and said it had stopped issuing certificates with the problem. As remediation, KIR said it performed a full scan, found no additional affected certificates, and changed its process so internal orders are handled like external customer requests, with added blacklist and two-level validation controls. The bug was later resolved after KIR reported the changes had been deployed and stated there were no further actions.
- Two certificates were identified with an incorrect organizationName value of "Bank Testowy".
- The remaining affected certificate was revoked.
- KIR reported that the process changes had been deployed to production.
- Lebihan representative — Reported two certificates with organizationName set to "Bank Testowy" and linked the crt.sh records.
- Kir representative — Said one certificate was revoked and the other would be revoked the next day.
- Community commenter — Warned that the revocation did not appear to be happening within the required time.
- Kir representative — Confirmed the remaining certificate had been revoked.
- Kir representative — Submitted an incident report describing the cause, timeline, and remediation steps.
- Kir representative — Explained the order flow and said the wrong organizationName was not noticed by one operator.
- Kir representative — Provided a timeline for the automation project and described the scan performed against CRM data and certificate data.
- Kir representative — Reported that the changes had successfully deployed to production.
- Kir representative — Said there were no additional actions and the bug could be closed.