← China Financial Certification Authority (CFCA) cases
Bugzilla #1802845
Ca Certificate Compliance
CFCA: EV certificate with wrong PostalCode&Street
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) identified a compliance issue involving the misissuance of EV certificates with interchanged PostalCode and Street fields. The problem was discovered during a review of historically issued certificates using a custom lint tool. CFCA promptly revoked several affected certificates and committed to revoking the remaining ones by December 2, 2022. They implemented a custom lint upgrade to prevent future occurrences and are advancing the development of additional verification functions. The case has been resolved, with CFCA demonstrating improved compliance measures and automation in their certificate issuance process.
Chronology
- CFCA discovered PostalCode and Street interchange errors in historically issued certificates.
- CFCA completed the revocation of the identified problematic certificates.
- The case was officially closed by Mozilla.
Thread Activity
- China Financial Certification Authority (CFCA) — CFCA reported the discovery of errors in issued certificates and outlined the steps for revocation.
- China Financial Certification Authority (CFCA) — CFCA provided a detailed timeline of actions taken in response to the compliance issue.
- China Financial Certification Authority (CFCA) — CFCA summarized improvements made in their processes and requested case closure.
- Mozilla representative — Mozilla announced the intention to close the case.
Participants
China Financial Certification Authority (CFCA)
Community commenter
Mozilla representative
External References
Similar Local Cases
CFCA: Certificate with wrong crlDistributionPoints
CFCA: ICA without EKU
DigiCert: Issuance of Cert with Compromised Key
IdenTrust: Mis-Issued EV Certificates
Hongkong Post: TLS certificates with basicConstraints not marked as critical
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs
KIR S.A.: Invalid localityName + CRL Revoked but OCSP Unknown
Verify GlobalSign's continued conformance to EV guidelines