← China Financial Certification Authority (CFCA) cases
Bugzilla #1838371
Certificate Misissuance
CFCA: certificate with an incorrect OrganizationName
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) issued an OV SSL certificate for the domain www.hncdi.gov.cn, which incorrectly listed the organization name as 海南新境界软件有限公司 (Hainan New Realm Software Co., Ltd.), while the actual registrant was the Hainan Provincial Commission for Discipline Inspection of the Communist Party of China. Following the report of this misissuance, CFCA acknowledged the issue and confirmed that a total of 22 certificates with similar discrepancies would be revoked. The revocation was completed on November 5, 2023. CFCA has since updated its verification processes to ensure that the organization name in certificates aligns with the WHOIS domain name registrant.
Chronology
- CFCA issued the incorrect certificate.
- CFCA completed the revocation of the misissued certificates.
Thread Activity
- Duck representative — Reported the certificate authority information inconsistency.
- China Financial Certification Authority (CFCA) — CFCA explained that the issuance followed BR verification requirements.
- Mozilla representative — Identified the certificate as OV-misissuance.
- China Financial Certification Authority (CFCA) — CFCA confirmed the incident report would be provided.
- China Financial Certification Authority (CFCA) — CFCA announced the revocation of the misissued certificates.
Participants
Duck representative
China Financial Certification Authority (CFCA)
Mozilla representative
Sectigo
Community commenter
External References
Similar Local Cases
CFCA: EV Certificates misissued with incorrect businessCategory
Entrust: EV TLS Certificate cPSuri missing
CFCA: certificate basicConstraints extension not marked as critical
Sectigo: EV Certificate issuance with incorrect subject:serialNumber attribute value
Sectigo: Certificates with RSA keys where modulus is not divisible by 8
Certigna: Precertificate with a validity period greater than 398-days
Let's Encrypt: Duplicate Serial Numbers
GlobalSign: TLS OV Certificate containing unverified information