← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1746421
Certificate Misissuance
PKIoverheid: (KPN) Incorrect Subject OrganizationName
RESOLVED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The case involves PKIoverheid (KPN) addressing an issue with 16 server certificates that incorrectly listed the organization name 'Dienst Uitvoering Onderwijs test'. The problem was initially reported via email on December 6, 2021, but was not received by the correct team due to incorrect contact information. After the issue was identified, KPN revoked the certificates on December 16, 2021, and has since amended its validation procedures to prevent future occurrences. A post-mortem report is being prepared to detail the incident and corrective actions taken.
Chronology
- Abuse report sent to Logius regarding incorrect organization name on certificates.
- KPN revoked the 16 incorrect certificates.
Thread Activity
- Logius representative — Logius received an abuse report regarding 16 issued server certificates.
- Logius representative — KPN adjusted its validation method to avoid reoccurrence.
- Logius representative — Guidelines for validation have been proposed and discussed with TSPs.
Participants
Logius representative
Thisisntrocket representative
Community commenter
Mozilla representative
External References
Similar Local Cases
Sectigo: Lack of input validation in stateOrProvinceName
Entrust: S/MIME mailbox address not in subjectAltName
SwissSign: MPKI step-up process sets wrong JoI Locality
SwissSign: Certificate with key length 16258
Entrust: SSL Certificates issued with Un-verified IP Addresses
e-commerce monitoring GmbH: CN domain not in SAN
IdenTrust: unintended creation of a Root CA certificate
GlobalSign: Invalid countryName