← Government of Hong Kong (SAR), Hongkong Post, Certizen cases
Bugzilla #1887008
Certificate Problem Report
Hongkong Post: TLS certificates with basicConstraints not marked as critical
RESOLVED
FIXED
Government of Hong Kong (SAR), Hongkong Post, Certizen
AI Summary
Hongkong Post issued TLS certificates with the basicConstraints extension present but without the required critical flag, violating BR 7.1.2.7.6. This issue was identified during an investigation linked to another bug report. A total of 46 affected certificates were issued since the effective date of the new requirement on September 15, 2023. Although there were no disruptions to services, the certificates needed to be revoked and replaced. The root cause was traced to a system bug in the certificate issuance process, which has since been addressed.
Chronology
- BR for TLS 2.0.0 became effective.
- Notified about TLS certificates issued without the critical flag.
- Identified the system bug causing the issue.
- All affected certificates were revoked.
Participants
Man Ho
External References
Similar Local Cases
Hongkong Post: TLS certificates with Certificate Policies extension that does not assert http scheme
Hongkong Post: Certificates with invalid embedded SCT signature
Hongkong Post: Subject CN converted to Unicode representation incident
Hongkong Post e-Cert CA 1 - 10 issuing certificates without subject alternative name extension
Hongkong Post: Delayed response to CPR
TWCA: TLS certificates with non-critical basicConstraints
Disig: TLS certificate with basicConstraints not marked as critical
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information