← NAVER Cloud Trust Services cases
Bugzilla #1866448
Certificate Misissuance
Incident
NAVER Cloud Trust Services: DV Certificate issued with improperly validated
RESOLVED
FIXED
NAVER Cloud Trust Services
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
NAVER Cloud Trust Services reported a misissuance of a Domain Validation (DV) certificate due to improper validation during testing of their new certificate issuance service, NCP Certificate Manager. The certificate was issued on November 24, 2023, after a QA team member inadvertently accessed an approval link in an email, leading to a bypass of standard validation procedures. Upon realizing the error, NAVER revoked the certificate immediately and initiated an investigation. They identified the root cause as excessive access rights granted to the QA team and have since implemented measures to prevent recurrence, including modifying the email approval process. The incident has been resolved with no further misissuance found.
Chronology
- A DV certificate was improperly validated and issued.
- The certificate was revoked immediately upon discovery of the issue.
- NAVER implemented changes to the email approval process to enhance security.
Thread Activity
- Navercorp representative — NAVER Cloud Trust Services inform that a DV certificate was improperly validated and issued.
- Navercorp representative — An incident report was posted detailing the misissuance and corrective actions.
- Navercorp representative — NAVER confirmed that all analysis and actions have been completed.
Participants
Navercorp representative
Community commenter
Mozilla representative
External References
Similar Local Cases
NAVER Cloud Trust Services: commonName not in SAN
NAVER Cloud Trust Services: Certificate issued with incorrect OCSP URI in AIA
NAVER Cloud Trust Services: Incorrect keyUsage for ECC certificate
NAVER Cloud Trust Services: DV certificate issued with no subject alternative name extension
Actalis: Issuance of intermediates after 2020-08-20 that do not comply with Mozilla Policy and the Baseline Requirements
SwissSign: MPKI step-up process sets wrong JoI Locality
SSL.com: CAA Empty set handling results in Wildcard issuance
Izenpe: certificate issued to internal domain