← Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) cases
Bugzilla #1875942
Ca Certificate Compliance
FNMT: Certificates issued included Policy qualifiers other than id-qt-cps
RESOLVED
FIXED
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
On January 22, 2024, FNMT discovered that it had issued 712 TLS certificates since September 15, 2023, which included Policy Qualifiers other than id-qt-cps, violating BR 7.1.2.7.9. Following this discovery, FNMT suspended the issuance of these certificates and began notifying affected subscribers to revoke their certificates. The CA completed the revocation of all affected certificates within five days. A detailed incident report was provided, outlining the root cause as a failure in the profile review process and reliance on a single reviewer. FNMT has since implemented corrective actions, including a checklist for profile reviews and enhanced monitoring tools.
Chronology
- FNMT discovers issuance of non-compliant TLS certificates.
- All affected certificates have been revoked.
- FNMT requests closure of the bug after successful remediation.
Thread Activity
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT realizes it has issued non-compliant certificates and suspends their issuance.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT provides a detailed incident report and outlines the impact and timeline.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — All affected certificates have been revoked within 5 days.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT confirms successful implementation of remediation items and requests bug closure.
Participants
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
Mozilla representative
External References
Similar Local Cases
FNMT: Findings in 2019 Audit Statement, including domain validation methods, CAA, etc.
FNMT: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy
Sectigo: Subject field with unvalidated information included in certificates
Buypass: TLS certificates with incorrect Subject attribute order
Actalis: pre-certificates with “certificateHold” as the revocation reason
NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit
e-commerce monitoring GmbH: CN domain not in SAN
Asseco DS / Certum: S/MIME certificates with error in subjectAlternativeName