FNMT: Invalid localityName

This case concerns FNMT certificates that were issued with an invalid localityName value. FNMT became aware of the issue via an incident/problem reporting email from a third party received on December 6, 2021. After a preliminary investigation, FNMT confirmed the certificate(s) must be revoked and revoked the initially reported certificate on December 7, 2021. FNMT then analyzed the localityName field and discovered additional affected certificates, deciding to notify subscribers and revoke the remaining affected certificates within 5 days; FNMT later reported that the 10 remaining affected certificates were revoked on December 18, 2021. FNMT stated that the incorrect localityName was due to a mis-validation by a validation specialist and described process and control changes, including increased verification effort and implementing a technical control in its TLS request applications to validate locality/province based on official registries. FNMT reported that the planned controls were installed in production on February 22, 2022. The bug was resolved as FIXED.

1. 2021-12-06 FNMT received a third-party certificate problem report about a certificate issued with invalid localityName data.
2. 2021-12-07 FNMT revoked the initially reported certificate with invalid localityName.
3. 2021-12-18 FNMT revoked the remaining affected certificates with invalid localityName.
4. 2022-02-22 FNMT installed planned technical controls in production to ensure locality correctness for TLS certificate issuance.

1. 2021-12-07 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT reported that it confirmed the certificate with invalid localityName must be revoked and that it was revoked on December 7, 2021, and said a full report would follow.
2. 2021-12-14 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT provided a detailed timeline, stated the incorrect localityName was due to mis-validation by a validation specialist, listed affected certificate crt.sh IDs, and described planned technical controls and subscriber notification.
3. 2021-12-20 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT updated that the 10 remaining affected certificates were revoked on December 18, 2021.
4. 2021-12-22 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT updated that it would implement a technical control to map postal code to a valid locality and province using official registries, and estimated production readiness by 31/03/2022.
5. 2022-01-12 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT updated that it decided to integrate the Spanish National Institute of Statistics (INE) as the official registry source and that development was underway.
6. 2022-02-23 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT updated that planned controls for locality correctness were successfully installed in production on February 22.
7. 2022-04-11 Mozilla representative — Mozilla suggested closing the bug as of April 13, 2022 if there were no additional questions.