PKIoverheid: KPN CPS Lists Forbidden Domain Validation Method 3.2.2.4.6

The case involves PKIoverheid's discovery that KPN's Certificate Policy Statement (CPS) included a forbidden domain validation method (3.2.2.4.6). The issue was identified following a discussion in the Mozilla dev-security-policy mailing list. In response, KPN initiated an analysis and began drafting a new version of their CPS. The CA has since implemented a modified ballot template to improve compliance checks and is exploring automation for detecting CPS updates. The issue has been resolved, and the new processes are expected to prevent similar occurrences in the future.

1. 2021-07-07 KPN identified a forbidden domain validation method in their CPS.
2. 2021-07-29 PKIoverheid confirmed the use of a new ballot template.
3. 2021-09-13 Automation for detecting CPS changes was implemented.

1. 2021-07-07 Logius representative — KPN noticed a message from Andrew Ayer regarding the forbidden validation method.
2. 2021-07-09 Logius representative — KPN started analysis and informed PKIoverheid.
3. 2021-08-17 Logius representative — Automation for CPS detection was expected to be ready within two weeks.
4. 2021-09-16 Logius representative — The bug was proposed to be closed.