GoDaddy: Misissuance of Cross Signed Certs
GoDaddy reported that on 06/22/2022 it mis-issued two cross certificates (subordinate CA certificates) with not valid after dates of 06/22/2032. The certificates used generalizedTime encoding instead of UTCtime encoding, which GoDaddy stated violates Baseline Requirements section 7.1.2.4 and RFC 5280 4.1.2.5 regarding UTCTime encoding for validity dates through the year 2049. GoDaddy said the issue was identified after the production certificates were generated when crt.sh linters produced time encoding errors. In response, GoDaddy fixed the OpenSSL configuration/scripts used to generate the certificates to systematically use the correct time format, and stated the issue was isolated to these two certificates (subscriber certificates were not impacted). GoDaddy also deployed an updated CRL (sfroot-g2.crl) and verified the certificates were showing revoked, and reported that the two mis-issued certificates were revoked on 6/27/2022. The bug was marked RESOLVED with resolution FIXED, and GoDaddy later stated it completed updating and testing its ceremony process to prevent similar issues and that the bug could be closed.
- GoDaddy generated two cross certificates with generalizedTime encoding for the not-valid-after dates.
- GoDaddy revoked the two mis-issued cross certificates and updated the CRL to reflect revocation.
- Bug status was last changed to RESOLVED (FIXED).
- GoDaddy — Opened the bug describing the misissuance, how it was discovered via crt.sh linter time encoding errors, the corrective actions taken (fixing generation scripts/configuration), and revocation/CRL updates; included crt.sh links for the affected certificates.
- Mozilla representative — Noted that Bug 1777270 was marked as a duplicate of this bug.
- GoDaddy — Said there were no formal updates and that GoDaddy would continue tracking for community questions.
- Mozilla representative — Reset the assignee because the bug assignee was inactive on Bugzilla.
- Mozilla representative — Indicated the bug would be closed on or about 12-Aug-2022 if there were no further questions.
- GoDaddy — Reported completion of updates and testing to the ceremony process to prevent similar issues and asked to close the bug.