← China Financial Certification Authority (CFCA) cases
Bugzilla #1793053
Ca Certificate Compliance
CFCA: ICA without EKU
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) discovered that its Intermediate Certificate Authority (ICA), CFCA DV OCA, was issued without the Extended Key Usage (EKU) extension. This issue was reported on August 15, 2022, leading CFCA to review its certificate issuance process. CFCA revoked the problematic ICA on September 19, 2022, and implemented corrective measures, including the introduction of automated detection tools (Zlint) to prevent future occurrences. The CA has since completed the development and testing of these tools, ensuring that all certificates will be verified before issuance. The case has been resolved, and CFCA has applied for closure of the bug.
Chronology
- CFCA received a report regarding the ICA lacking EKU.
- CFCA revoked the ICA CFCA DV OCA.
- CFCA applied Zlint service for automatic certificate verification.
Thread Activity
- China Financial Certification Authority (CFCA) — CFCA reported the ICA issue and outlined the timeline of actions taken.
- China Financial Certification Authority (CFCA) — CFCA summarized improvements made over the past year and requested case closure.
- Mozilla representative — Mozilla indicated plans to close the case unless further issues arise.
Participants
China Financial Certification Authority (CFCA)
Mozilla representative
External References
Similar Local Cases
CFCA: Certificate with wrong crlDistributionPoints
CFCA: EV certificate with wrong PostalCode&Street
KIR S.A.: Invalid localityName + CRL Revoked but OCSP Unknown
Hongkong Post: TLS certificates with Certificate Policies extension that does not assert http scheme
Camerfirma: suspicious certificate for com.com
IdenTrust: OCSP Signer Certificate Missing No-Check Extension
Hongkong Post: TLS certificates with basicConstraints not marked as critical
e-commerce monitoring GmbH: CN domain not in SAN