CFCA: certificate basicConstraints extension not marked as critical

The China Financial Certification Authority (CFCA) reported a compliance issue where the basicConstraints extension was not marked as critical in 2,098 SSL certificates issued between September 15, 2023, and March 19, 2024. Upon receiving a notification from a user, CFCA confirmed the issue, immediately ceased certificate issuance, and rectified the problem by updating the system configuration. The affected certificates were revoked, and new compliant certificates were issued. CFCA has since prepared an incident report and outlined steps for improvement, including upgrading their linting tools and revising internal specifications.

1. 2024-03-19 CFCA confirmed the issue and stopped issuing certificates.
2. 2024-03-20 CFCA resumed certificate issuance after fixing the issue.
3. 2024-09-12 CFCA completed all improvement measures related to the incident.

1. 2024-03-19 China Financial Certification Authority (CFCA) — CFCA received a report about the basicConstraints extension issue and confirmed the problem.
2. 2024-04-01 China Financial Certification Authority (CFCA) — CFCA provided a detailed summary of the incident and the corrective actions taken.
3. 2024-09-12 China Financial Certification Authority (CFCA) — CFCA announced the completion of all improvement measures and requested to close the incident.