← Microsoft Corporation cases
Bugzilla #1718991
Ca Certificate Compliance
Certificate Misissuance
Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsoft PKI Services identified four Intermediate CA certificates that were mis-issued due to malformed Key Usage extensions. The issue was discovered on June 24, 2021, during a manual inspection of newly created certificates. In response, Microsoft revoked the mis-issued certificates within minutes of their creation and repaired the template that caused the issue. The CA has since updated its template creation process to prevent similar incidents in the future. All planned remediations have been completed, and the case has been resolved.
Chronology
- Microsoft identified four Intermediate CA certificates with malformed Key Usage extensions.
- Microsoft revoked the mis-issued certificates and repaired the template.
- Microsoft completed all planned remediations for the issue.
Thread Activity
- Microsoft Corporation — Microsoft PKI Services reported the discovery of malformed Key Usage extensions in four Intermediate CA certificates.
- Mozilla representative — A Mozilla engineer indicated that Firefox rejects the mis-issued CAs, suggesting they should not be added to the CCADB.
- Microsoft Corporation — Microsoft confirmed the completion of all planned remediations for the issue.
Participants
Microsoft Corporation
Community commenter
Mozilla representative
External References
Similar Local Cases
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs
Microsoft PKI Services: Underscore in SAN
Microsoft PKI Services: Certificate Mis-Issuance, Locality Missing
Microsoft PKI Services: DV certificate issued with OV fields
Microsoft PKI Services: CA Certificates not published in DER Encoded Format
NetLock: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy
Microsoft PKI Services: Loss of Archived Firewall logs from Retention Store
Microsoft DSRE PKI: problem reporting e-mail in CPS does not work