← Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) cases
Bugzilla #1884532
Certificate Misissuance
ACCV: Certificates issued with cRLIssuer in CDP extension
RESOLVED
FIXED
Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The Autoritat de Certificació de la Comunitat Valenciana (ACCV) reported an incident involving the issuance of 837 certificates that incorrectly included the cRLIssuer field in the CRL Distribution Points extension, violating the Baseline Requirements. The misissuance was detected during a routine review on March 9, 2024, leading to an urgent meeting and confirmation of the issue. All affected certificates were revoked by March 14, 2024. ACCV has since implemented changes to its internal protocols and introduced new linting tools to prevent future occurrences. The incident report was updated to address feedback from the community regarding the initial submission.
Chronology
- ACCV detected misissued certificates during a routine review.
- All affected certificates were revoked.
- ACCV deployed pkilint as a pre-linting mechanism.
Thread Activity
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Reported the incident involving incorrectly issued certificates.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Confirmed that all affected certificates have been revoked.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Updated the incident report to address community feedback.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — Announced deployment of pkilint for pre-linting.
Participants
Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV)
Google representative
Mozilla representative
External References
Similar Local Cases
Entrust: EV Certificate missing Issuer’s EV Policy OID
CFCA: certificate basicConstraints extension not marked as critical
Certigna: TLS certificates with Basic constraint non-critical
Sectigo: Incorrectly included registrationStateOrProvince in PSD-based cabfOrganizationIdentifier extension
Entrust: Delay in Updating CPS
SECOM: Certificates Issued with lower case value in subject:countryName
Disig: Two certificates with same serial number
Telia: Issued three precertificates with non-NIST EC curve