Microsoft PKI Services: Certificate Misissuance — DNSName not FQDN (hyphen at end of label)

Microsoft PKI Services reported that it identified three certificates that were mis-issued because their SAN DNSName values were not fully qualified domain names, specifically due to a hyphen at the end of a label. Microsoft said it discovered the issue on 20 April 2021 while investigating preferred name syntax errors related to Bug 1705419. In response, Microsoft updated its internal linting tools on 15 April 2021 to improve checks for preferred name syntax in SAN and stated it did not stop certificate issuance because the updated controls were intended to prevent further issuance of this type. Microsoft confirmed that all three identified certificates were revoked and that the appropriate CRLs were published, and it stated the certificates were revoked within 24 hours of discovery. Microsoft later reported that its review found no additional certificates beyond the three in this bug and the five identified in Bug 1705419, and it requested that remediation be tracked in Bug 1705419. Mozilla indicated it would close the bug on or about 4 June 2021 unless there were reasons to keep it open, and the bug is resolved as FIXED.

1. 2021-04-20 Microsoft discovered three mis-issued certificates with SAN DNSName values that were not FQDNs due to a hyphen at the end of a label.
2. 2021-04-21 Microsoft revoked the three identified certificates and published the appropriate CRLs.
3. 2021-05-28 Microsoft completed its review and reported no additional affected certificates beyond those previously identified.

1. 2021-04-22 Microsoft Corporation — Microsoft explained it discovered three mis-issued certificates (DNSName not FQDN due to hyphen at end of label), updated internal linting tools on 15 April 2021, confirmed revocation and CRL publication on 21 April 2021, and provided CT/crt.sh links.
2. 2021-05-28 Microsoft Corporation — Microsoft stated its review found no additional certificates beyond the three in this bug and the five in Bug 1705419, and asked to resolve this bug while tracking remediation in Bug 1705419.
3. 2021-06-01 Mozilla representative — Mozilla said it would close this bug on or about Friday, 4-June-2021 unless there were reasons to keep it open.