Asseco Data Systems / Certum: Cross-certificate with wrong policy identifier
This case concerns a cross-certificate issued by Asseco Data Systems S.A. (Certum) for the Root CA “UCA Global G2 Root” owned by Shanghai Electronic Certification Authority Co., Ltd. (SHECA). During analysis of another Mozilla Bugzilla issue (1815355), Certum discovered that the cross-certificate contained a problematic Certificate Policies identifier, specifically involving the “anyPolicy” identifier. Certum stated that it had issued an additional cross-certificate with the wrong policy identifier and informed SHECA that the cross-certificate needed revocation. Certum and SHECA decided to revoke the current cross-certificate and to issue a new cross-certificate with a correct policy identifier and additional technical protection (dedicated OIDs in the certificatePolicies extension). The thread includes a separate bug for delayed revocation (1825734). The cross-certificate was revoked on 2023-04-28, and the reporter indicated there were no further updates.
- A problematic cross-certificate for SHECA was issued with the problematic policy identifier.
- Certum identified an additional cross-certificate issue during analysis of Bug 1815355 and opened this bug to address cross-certificate handling.
- Certum asked SHECA to revoke the problematic cross-certificate.
- The problematic cross-certificate was revoked.
- Asseco Data Systems S.A. — Reported that analysis of Bug 1815355 found the same “anyPolicy” identifier issue also applied to cross-certificate https://crt.sh/?id=2515580578 for UCA Global G2 Root (SHECA) and said clarification would follow.
- Google representative — Asked Wojciech to provide a more specific timeline than “soon” and to set an appropriate nextUpdate flag.
- Asseco Data Systems S.A. — Committed to providing an answer no later than 2023-03-22 and asked to set that date as nextUpdate.
- Assecods representative — Provided details on when Certum became aware, the actions taken (including informing SHECA and requesting permission to issue a new cross-certificate), and the plan to revoke and replace the cross-certificate with dedicated OIDs; noted a separate bug for delayed revocation.
- Assecods representative — Stated that on 2023-03-28 Certum issued a new cross-certificate for SHECA and referenced the separate revocation-delay bug 1825734.
- Assecods representative — Said SHECA’s revocation would take place by 2023-04-28.
- Assecods representative — Announced that the cross-certificate was revoked on 2023-04-28.
- Assecods representative — Indicated there were no further updates and asked if there were any questions.