← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1706950
Self Incident Disclosure
PKIoverheid: KPN issued Invalid organizationalUnitName
RESOLVED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The case involves a misissuance incident where KPN, a certificate authority under PKIoverheid, issued a certificate with an invalid organizationalUnitName. The CA became aware of the issue through a Bugzilla notification and took immediate action, including informing the affected customer and revoking the erroneous certificate. Affected certificates were confirmed to be limited to one, and KPN implemented regex validation on the OU field to prevent future occurrences. The CA also committed to enhancing its validation processes and introduced a post-issuance linting tool to further mitigate risks. The issue has been resolved, and the bug is now closed.
Chronology
- Issuance of certificate with invalid OU field
- Certificate revoked and validation checks implemented
Thread Activity
- Lebihan representative — Reported the invalid organizationalUnitName in a certificate.
- Logius representative — Provided a timeline of actions taken in response to the misissuance.
- Logius representative — Confirmed the installation of the linting tool on production.
Participants
Lebihan representative
Logius representative
Community commenter
Mozilla representative
External References
Similar Local Cases
PKIoverheid: Incorrect OCSP Delegated Responder Certificate
PKIoverheid: KPN CPS Lists Forbidden Domain Validation Method 3.2.2.4.6
PKIoverheid: CIBG insufficient serial number entropy
PKIoverheid: (KPN) Incorrect Subject OrganizationName
PKIoverheid: Missing Intermediate CA from audit statement
PKIoverheid: Delayed audit statements for intermediate CAs
PKIoverheid: Delayed S/MIME audit report for MoD PKIoverheid G3 CA
PKIoverheid: Compliance issues CIBG TLS certificates