← Krajowa Izba Rozliczeniowa S.A. (KIR) cases
Bugzilla #1705657
Certificate Problem Report
KIR S.A.: Many certificates with OCSP Unknown
RESOLVED
FIXED
Krajowa Izba Rozliczeniowa S.A. (KIR)
AI Summary
Krajowa Izba Rozliczeniowa S.A. (KIR) faced issues with many certificates returning an OCSP status of 'Unknown'. This situation arose due to procedural controls that were insufficient to prevent the issuance of certificates that were not delivered to clients. KIR acknowledged the problem and initiated a series of procedural and technical changes to address the issue. They reported that a technical change was implemented to ensure that all certificates would be correctly reflected in OCSP responses. Following these changes, KIR confirmed that no certificates with an OCSP status of 'Unknown' were found after a full scan.
Chronology
- KIR's procedural controls deemed insufficient; recommendation to halt issuance.
- Implementation of technical changes began.
- Technical changes deployed in production.
Participants
Piotr Grabowski
Michel Le Bihan
Ryan Sleevi
Elżbieta Włodarczyk
External References
Similar Local Cases
KIR S.A.: CN domain not in SAN
KIR S.A.: Invalid organizationName
KIR S.A.: Invalid localityName + CRL Revoked but OCSP Unknown
KIR S.A.: DV certificates with locality name, organization name and stateOrProvinceName
KIR S.A.: Certificates issued greater than stated in CPS
KIR S.A.: O > 64 characters
Telekom Security: Multiple commonName in certificates
KIR: Intermediate CA - SZAFIR Trusted CA3 - Certificate Policies extension - non-compliance