← Krajowa Izba Rozliczeniowa S.A. (KIR) cases
Bugzilla #1705832
Certificate Problem Report
KIR S.A.: DV certificates with locality name, organization name and stateOrProvinceName
RESOLVED
FIXED
Krajowa Izba Rozliczeniowa S.A. (KIR)
AI Summary
Krajowa Izba Rozliczeniowa S.A. (KIR) issued DV certificates that incorrectly included organizationName, localityName, and stateOrProvinceName fields, violating compliance policies. The issue was identified shortly after issuance, leading to the revocation of the certificates. KIR acknowledged the mistake was due to a human error in applying the wrong policy OID and has since implemented measures to prevent recurrence, including improved naming conventions and a review process for new entries. Despite the prompt revocation, KIR initially did not classify the incident as reportable, which raised concerns among participants regarding their compliance practices.
Chronology
- Two certificates issued with incorrect OID
- Certificates revoked after issue was identified
- Bug reported in Bugzilla
- Bug closed as fixed
Participants
Michel Le Bihan
Piotr Grabowski
Ryan Sleevi
Paul Steinberg
George Fozzie
Ben Wilson
External References
Similar Local Cases
KIR S.A.: Invalid organizationName
KIR S.A.: CN domain not in SAN
KIR S.A.: Invalid localityName + CRL Revoked but OCSP Unknown
KIR S.A.: Many certificates with OCSP Unknown
GlobalSign: Invalid stateOrProvinceName value
e-commerce monitoring GmbH: CN domain not in SAN
KIR S.A.: Certificates issued greater than stated in CPS
KIR S.A.: O > 64 characters