D-TRUST: Wrong key usage (Key Agreement)

RESOLVED FIXED D-TRUST

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

D-TRUST identified a compliance issue where a certificate was incorrectly issued with the key usage 'keyAgreement' instead of 'keyEncipherment'. This misissuance occurred on February 17, 2022, shortly after a new product type was introduced. Upon detection by the quality assurance team, D-TRUST promptly revoked the affected certificate and halted further issuance of this product type. The CA has since implemented additional checks and rolled back the product to prevent future occurrences. The issue has been resolved, and the CA has contributed to the Z-Lint project to enhance detection of similar errors.

Model: gpt-4o-mini Generated: 2026-06-13 21:22 UTC Revised: 2026-06-16 18:40 UTC Confidence: 0.90 15 comments

Chronology

2022-02-17 D-TRUST issued a certificate with incorrect key usage.
2022-02-17 D-TRUST revoked the incorrectly issued certificate.
2022-03-12 D-TRUST rolled back the new product type.
2022-07-13 D-TRUST contributed changes to the Z-Lint project.

Thread Activity

2022-02-18 Bdr representative — D-TRUST reported the incident and outlined the timeline of events.
2022-02-25 Bdr representative — D-TRUST provided an update on the incident report and actions taken.
2022-03-05 Bdr representative — D-TRUST updated on the implementation of additional checks.
2022-07-13 Bdr representative — D-TRUST confirmed the completion of measures and requested closure of the bug.
2022-07-13 Mozilla representative — Mozilla indicated the bug would be closed shortly.

Participants

Bdr representative Mozilla representative

External References

Original Bugzilla Case crt.sh github.com

Similar Local Cases

#1793440 RESOLVED Self Reported Incident Certificate Misissuance Opened 2022-10-03 · Closed 2023-02-22 · 100% similar

D-TRUST: CRL not DER-encoded

AI Summary CA Owner

#1691117 RESOLVED Ca Certificate Compliance Certificate Misissuance Closure Request Opened 2021-02-05 · Closed 2023-02-22 · 95% similar

D-TRUST: Certificate with RSA key where modulus is not divisible by 8

AI Summary CA Owner

#1939809 RESOLVED Ca Certificate Compliance Certificate Misissuance Closure Request Opened 2025-01-03 · Closed 2026-06-12 · 95% similar

D-Trust: QCStatement with http link of PKI Disclosure Statements

AI Summary CA Owner

#1563772 RESOLVED Self Reported Incident Opened 2019-07-05 · Closed 2026-06-12 · 90% similar

D-TRUST: Precertificate OU > 64 Characters

AI Summary CA Owner

#1509512 RESOLVED Self Reported Incident Opened 2018-11-23 · Closed 2023-02-22 · 89% similar

D-TRUST: syntax error in one tls certificate

AI Summary CA Owner

#1861069 RESOLVED Certificate Misissuance Opened 2023-10-25 · Closed 2026-06-12 · 89% similar

D-Trust: Issuance of 15 DV certificates containing ‘serialNumber’ field within subject

AI Summary CA Owner

#1567588 RESOLVED Self Reported Incident Opened 2019-07-19 · Closed 2023-02-22 · 88% similar

D-TRUST: incorrectly formatted businessCategory entry

AI Summary CA Owner

#2012511 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2026-01-26 · Closed 2026-04-19 · 87% similar

D-Trust: CRL HTTP Media Type

AI Summary CA Owner