← Government of Hong Kong (SAR), Hongkong Post, Certizen cases
Bugzilla #1886406
Ca Certificate Compliance
Hongkong Post: TLS certificates with Certificate Policies extension that does not assert http scheme
RESOLVED
FIXED
Government of Hong Kong (SAR), Hongkong Post, Certizen
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Hongkong Post CA reported a compliance issue regarding the policyQualifiers attribute in the Certificate Policies extension of TLS certificates, which did not align with the updated Baseline Requirements effective from September 15, 2023. The CA acknowledged the oversight and committed to removing the non-compliant attribute from non-EV TLS certificates while ensuring compliance for EV TLS certificates. A total of 1,176 affected certificates were identified, primarily issued to government entities in Hong Kong. The CA has revoked 1,090 of these certificates and implemented new pre-issuance linting tools to prevent future occurrences. The case is now resolved with all action items completed.
Chronology
- All affected certificates were revoked.
Thread Activity
- Certizen representative — Created an incident report regarding the compliance issue with the Certificate Policies extension.
- Certizen representative — Resumed issuance of TLS certificates after patching the system.
- Certizen representative — Confirmed that all affected certificates have been revoked.
- Certizen representative — Requested closure of the bug as all action items have been finalized.
Participants
Certizen representative
Sectigo
Community commenter
Mozilla representative
External References
Similar Local Cases
Hongkong Post: TLS certificates with basicConstraints not marked as critical
SSL.com: Issuance of one Sponsored-Validated S/MIME certificate with organization information in givenName and surName of the subjectDN
Certigna: TLS certificates with Basic constraint non-critical
Hongkong Post: Certificates with invalid embedded SCT signature
Financijska agencija (Fina): Mis-issued certificates
Chunghwa Telecom: Wrong Extended Key Usage setting by GTLSCA
Sectigo: Mojibake in certificate Subject fields
Buypass: Domain validation method using externally operated DNS tools