Telia: Misissued certificate with incorrect OrganizationName value "Hair 8 Brains"
Telia reported a misissuance incident involving a certificate with an incorrect OrganizationName value (“Hair 8 Brains”). Telia CA Security Manager discovered the issue during routine daily review of certificate compliance verification via a post-issuance report on 13 April 2023. Telia stated that the certificate had been enrolled with an incorrect organization name after secondary approval/processing, and that the issue was identified by Telia CA administrators. Telia revoked the misissued certificate on 13 April 2023 and informed relevant internal parties, including reporting the issue and revocation after informing the certificate subject. Telia’s Security Manager reviewed the incident and determined it required public disclosure as a violation of CP/CPS section 3.2 and applicable Baseline Requirements and root program policies, then initiated Telia’s internal incident management and disclosure process to Mozilla. Telia later confirmed remediation actions, including immediate RA re-training and steps to prevent a Registration Officer from changing subject data in the validation phase in the portal. The bug was requested to be closed after planned activities were completed, and Mozilla indicated it would close it on or about 30 June 2023; the bug status is RESOLVED with resolution FIXED.
- Telia discovered a misissued certificate with an incorrect OrganizationName value during routine post-issuance compliance review and identified the incorrect organization entry.
- Telia revoked the misissued certificate after confirming the incorrect OrganizationName value.
- Telia initiated its internal incident management and public disclosure process to Mozilla after determining the incident required disclosure.
- Telia completed immediate RA trainings as part of remediation.
- Telia confirmed additional remediation steps were completed and considered the incident and root cause resolved as planned.
- Mozilla closed the bug on or about 30 June 2023 after no further issues were raised.
- Teliasonera representative — Reported that Telia CA accepted an invalid OrganizationName (O) value, described how the issue was discovered via the daily post-issuance report, and provided a timeline including revocation and initiation of public disclosure.
- Mozilla representative — Posted that the Bugbug bot thinks the bug is invalid and suggested reopening/moving components if needed.
- Teliacompany representative — Confirmed immediate RA trainings were completed by 20.04.2023 as the first remediation action.
- Teliacompany representative — Confirmed further remediation actions were completed, including preventing Registration Officer capability to change subject data in the validation phase, and stated the incident/root cause was resolved as planned.
- Teliacompany representative — Requested closure, stating planned activities were completed and there were no additional requests or comments.
- Mozilla representative — Indicated the bug would be closed on or about Friday, 30-June-2023 unless issues remained to discuss.