← Government of Hong Kong (SAR), Hongkong Post, Certizen cases
Bugzilla #1887008
Ca Certificate Compliance
Hongkong Post: TLS certificates with basicConstraints not marked as critical
RESOLVED
FIXED
Government of Hong Kong (SAR), Hongkong Post, Certizen
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Hongkong Post identified a compliance issue where some TLS certificates were issued with the basicConstraints extension present but without the critical flag set, violating BR 7.1.2.7.6. This issue was discovered during an investigation related to another bug report. A total of 46 affected certificates were identified, primarily issued to government departments in Hong Kong SAR. The CA has halted issuance of new certificates and is collaborating with customers to replace the affected ones. All affected certificates have since been revoked, and the CA has implemented measures to prevent future occurrences, including upgrading their linting tools and certificate issuance system.
Chronology
- Hongkong Post notified of TLS certificates issued with basicConstraints extension but without the critical flag set.
- All affected certificates were revoked.
Thread Activity
- Certizen representative — Preliminary report on the compliance issue regarding basicConstraints extension.
- Certizen representative — All affected certificates were revoked.
- Certizen representative — Finalized all action items related to the incident and requested closure of the bug.
Participants
Certizen representative
Mozilla representative
External References
Similar Local Cases
Hongkong Post: TLS certificates with Certificate Policies extension that does not assert http scheme
Hongkong Post: Certificates with invalid embedded SCT signature
Entrust: S/MIME mailbox address case mismatch between subject and subjectAltName
NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit
IdenTrust: Mis-Issued EV Certificates
IdenTrust: OCSP Signer Certificate Missing No-Check Extension
e-commerce monitoring GmbH: CN domain not in SAN
Asseco DS / Certum: S/MIME certificates with error in subjectAlternativeName