NAVER Cloud Trust Services: DV certificates issued without Subject Alternative Name (SAN) extension
NAVER Cloud Trust Services reported that its NAVER Secure Certification Authority 1 issued 21 DV certificates without the Subject Alternative Name (SAN) extension field for three test domains. The issue was triggered after NAVER Cloud deployed a new internal certificate issuance system (“NAVER Domain Certificate Manager”, NDCM) on 2022-08-18, during which certificates were issued from 11:07 to 13:50 UTC. At 14:26 UTC, NAVER Cloud detected that the SAN extension field value was missing, revoked all 21 affected certificates by 14:29 UTC, and stopped issuing subscriber certificates through NDCM by 14:35 UTC. NAVER Cloud identified a root cause in NDCM: when requesting a certificate from NDCM to the CA engine, the value intended for the SAN extension DNS was sent as a NULL value and the system issued without error. NAVER Cloud then deployed an error-handling hotfix in the CA engine (2022-08-21) and a hotfix in NDCM to modify DNS values (2022-08-22). Later, NAVER Cloud reported completing automated Precertificate Linting in NDCM (test release on 2022-09-22; finished on 2022-10-04) to prevent issuance with warnings or errors, including this type of problem. The bug is marked RESOLVED with resolution FIXED, and Mozilla indicated in 2023-04-07 that there had been no further questions and it was inclined to close it around 2023-04-12.
- NAVER Cloud deployed NDCM and issued 21 DV certificates missing the SAN extension field for test domains.
- NAVER Cloud detected the missing SAN extension, revoked the 21 certificates, and stopped issuing via NDCM.
- NAVER Cloud deployed a CA engine hotfix adding error handling for missing SAN extension values.
- NAVER Cloud deployed an NDCM hotfix to ensure DNS values are written normally into the SAN extension.
- NAVER Cloud completed automated Precertificate Linting in NDCM to prevent issuance with SAN-related warnings or errors.
- Mozilla indicated it was inclined to close the incident around 2023-04-12 absent further reasons.
- Navercorp representative — Reported that NAVER Cloud issued 21 DV certificates without SAN extension fields for test domains and revoked them within about 3 hours, and stated a full report would follow.
- Thisisntrocket representative — Asked why 21 certificates were issued for what appeared to be three test domains.
- Navercorp representative — Provided an incident report describing detection time, revocation, stopping NDCM issuance, root cause (NULL SAN DNS value sent without error), and remediation steps including CA engine and NDCM hotfixes plus certificate listings via crt.sh links.
- Mozilla representative — Asked about progress on adding Precertificate Linting to NDCM and testing.
- Navercorp representative — Said Precertificate Linting was completed in the test environment on 2022-09-22 and would be released to the real environment the next week.
- Navercorp representative — Reported that automated Precertificate Linting was finished on 2022-10-04 and would prevent issuing certificates with warnings or errors, including this bug case.
- Navercorp representative — Reported that an internal audit found one additional same-case certificate issued within the past year, revoked immediately, and attributed it to the same root cause with prevention measures already completed.
- Mozilla representative — Noted there were no further questions/comments and it was inclined to close the incident around 2023-04-12.