Microsoft PKI Services: Malformed ICAs (missing certificate policy extensions)

Microsoft PKI Services identified a compliance issue involving eight Intermediate CA certificates that were missing the required certificatePolicies extension, as mandated by the CA/Browser Forum Baseline Requirements. The issue was first reported by their WebTrust auditor on May 4, 2021. In response, Microsoft acknowledged the issue, revoked the affected certificates, and implemented a series of remediation steps, including updating their issuance processes to include post-issuance checks using Zlint. They also committed to enhancing their procedures to prevent similar issues in the future, including plans for automated pre-issuance linting by December 2022. The case has been resolved with the necessary actions taken.

1. 2021-05-04 Issue reported to Microsoft PKI Services by their auditor.
2. 2021-05-06 Revocation of all eight affected ICA certificates completed.
3. 2022-12-01 Planned implementation of automated pre-issuance linting for CA certificates.

1. 2021-05-13 Microsoft Corporation — Initial report of the incident and acknowledgment of the issue.
2. 2021-05-21 Microsoft Corporation — Detailed root cause analysis provided, outlining the syntax error in the certificate policy extensions.
3. 2021-07-02 Microsoft Corporation — Update on the implementation of new processes to prevent future mis-issuances.
4. 2022-01-18 Microsoft Corporation — Confirmation of plans for automated pre-issuance linting and request to resolve the bug.