← Netlock cases
Bugzilla #1716874
Self Reported Incident
Revocation Issue
NetLock: Intermediate CA Certificate Missing from Audit Reports
RESOLVED
FIXED
Netlock
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
NetLock disclosed an issue regarding an intermediate CA certificate, 'NetLock OnlineSSL (Class Online) Tanúsítványkiadó', which was missing from their audit reports despite its capability to issue TLS server certificates. The problem was first identified on June 16, 2021, and was attributed to an administrative error in the audit report. Following discussions with auditors and Mozilla, NetLock acknowledged the mistake and decided to revoke the intermediate CA certificate. The revocation process was scheduled, and all necessary steps were completed by November 10, 2021, with the certificate officially revoked on September 28, 2021.
Chronology
- NetLock's audit report identified missing intermediate CA certificate.
- The intermediate CA certificate was revoked.
Thread Activity
- Mozilla representative — Netlock's audit report does not list the following CA Certificate even though it appears capable of issuing TLS server certificates.
- Netlock — The audit report contains a wrong SHA256 hash related to 'NetLock OnlineSSL (Class Online) Tanúsítványkiadó' CA.
- Netlock — We first became aware of the problem via comment #1 of this current ticket.
- Netlock — We are scheduling the process that will include revocation of the related intermediate CA.
- Netlock — All steps above have been done.
- Mozilla representative — It appears that this certificate was revoked on 9/28/2021.
Participants
Mozilla representative
Netlock
External References
Similar Local Cases
NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit
NETLOCK: SSL certificates with OU field
NetLock: Cumulative report connected to EV verification
NETLOCK: Intermediate CA Certificate not disclosed to CCADB
NETLOCK: Policy Qualifiers other than id-qt-cps is included in TLS certificates
NetLock: Non-BR-Compliant Certificate Issuance
NETLOCK: did not file a preliminary incident report or respond to a third-party report within the 72-hour timeframe
DigiCert: Incorrect OCSP Delegated Responder Certificate