NAVER Cloud Trust Services: DV certificate issued with no subject alternative name extension

NAVER Cloud Trust Services issued 21 DV certificates without the required Subject Alternative Name (SAN) extension for three test domains on August 18, 2022. The certificates were revoked within three hours of issuance upon detection of the error. The issue arose from a bug in their new internal certificate issuance system, which was promptly addressed by halting its use and implementing a Precertificate Linting procedure to prevent future occurrences. An internal audit later revealed a similar misissuance incident, but corrective measures were already in place to avoid recurrence.

1. 2022-08-18 Initial issuance of certificates without SAN extension fields
2. 2022-08-18 Detection of the missing SAN extension
3. 2022-08-18 Revocation of all affected certificates
4. 2022-09-22 Completion of Precertificate Linting procedure testing
5. 2022-10-04 Release of automated Precertificate Linting procedure
6. 2022-11-07 Discovery of an additional similar misissuance during internal audit