← Deutsche Telekom Security GmbH cases
Bugzilla #1875820
Certificate Problem Report
Telekom Security: TLS certificates with basicConstraints not marked as critical
RESOLVED
FIXED
Deutsche Telekom Security GmbH
AI Summary
Deutsche Telekom Security GmbH reported an issue with 816 TLS certificates that were issued without marking the basicConstraints as critical, violating BR 7.1.2.7.6. The error was identified during routine checks and was attributed to an oversight of changes in the TLS BR version 2.0.0. Although the incident did not lead to any security breaches or customer complaints, the affected customers were informed and asked to revoke the certificates. A delayed revocation was later decided for critical infrastructures that could not replace the certificates in time. All affected certificates have since been revoked.
Chronology
- Error message found during weekly checks
- Decision made to delay revocation for critical infrastructures
- All affected certificates revoked
- zlint updated in production environment
Participants
Arnold Essing
Stefan Kirch
External References
Similar Local Cases
Telekom Security: CRL also contained unrevoked certificates
Telekom Security: CRL-Entries with wrong CRL Reason Codes
Telekom Security: Multiple commonName in certificates
Telekom Security: Key Encipherment in two ECC SAN TLS certificates
Telekom Security: Wrong jurisdiction entries in certificates
Telekom Security / DFN: CRL of “DFN-Verein Certification Authority 2“ contains empty revoked certificate list
Telekom Security: Root-CA certificates published in PEM encoded format
Telekom Security: Improper use of a domain validation method