← Telia Company cases
Bugzilla #1856591
Certificate Misissuance
Telia: S/MIME certificates issued in violation of S/MIME BR v1.0.1
RESOLVED
FIXED
Telia Company
AI Summary
Telia Company reported the issuance of three S/MIME certificates that violated S/MIME Baseline Requirements (BR) v1.0.1. The certificates were issued by a technically constrained CA to Ericsson personnel and lacked required Policy OID and organization identifier. Upon discovery during a compliance review, Telia initiated an immediate investigation and confirmed the compliance issue. The affected certificates were revoked, and a full disclosure report was promised by October 10, 2023. Remedial actions included implementing daily compliance checks.
Chronology
- Telia CA discovered the compliance issue during a monthly review.
- Initial incident report opened in Mozilla Bugzilla.
- Problematic certificates were revoked.
- Full incident report submitted.
- Telia CA requested closure of the incident.
Participants
Antti Backman
External References
Similar Local Cases
Telia: TLS certificates issued in violation of TLS BR v2.0.1
Telia: S/MIME Misissuance incorrect AIA id-ca-caIssuer http:URI
Telia: TLS incorrect AIA caIssuer URI and incorrect CDP
Telia: S/MIME Misissuance - incorrect subject information for Multipurpose sponsor-validated-profile
Telia: Certificates Issued with lower case value in subject:countryName
Telia: S/MIME Certificate issued to expired domain
Telia: Misissued certificate - Invalid OU value "-"
Telia: invalid IP value in SAN DNS field