← Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM) cases
Bugzilla #1847193
Certificate Misissuance
KAMU SM: commonName not in SAN
RESOLVED
FIXED
Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
KAMU SM identified a compliance issue where a certificate was issued without the commonName (CN) field included in the Subject Alternative Name (SAN) extension. Upon discovery on August 4, 2023, the affected certificate was revoked immediately. The CA conducted a thorough investigation, confirming that the misissuance was due to human error during the certificate issuance process. KAMU SM implemented additional controls in their checklist to prevent similar incidents and has since integrated pre-issuance linting into their certificate management infrastructure. As of September 27, 2023, all remediation actions have been completed, and the incident is now resolved.
Chronology
- KAMU SM discovered a certificate was issued without a CN field in the SAN extension.
- Pre-issuance linting and other remediation measures became operational.
Thread Activity
- Tubitak representative — Kamu SM discovered that a certificate was issued without a CN field in the SAN extension. The affected certificate was revoked immediately.
- Tubitak representative — KAMU SM provided a detailed timeline of actions taken in response to the misissuance.
- Tubitak representative — KAMU SM updated their checklist to include additional controls.
- Tubitak representative — KAMU SM confirmed that pre-issuance linting is operational in the production environment.
Participants
Tubitak representative
Binaryparadox representative
Mozilla representative
External References
Similar Local Cases
Kamu SM: "Some-State" in stateOrProvinceName
Kamu SM: Non-BR-Compliant Certificate Issuance
Financijska agencija (Fina): Mis-issued certificates
e-commerce monitoring GmbH: CN domain not in SAN
SwissSign: Certificate with key length 16258
Izenpe: Duplicate attribute in Subject
certSIGN: misissued an OV SSL certificate with no organizationName and localityName, instead of a DV SSL as requested by client
DigiCert: Encoded HTML entities in attribute values