← Chunghwa Telecom cases
Bugzilla #1892419
Delayed Revocation
Chunghwa Telecom: Delayed Revocation Due to GTLSCA EKU Misissuance
RESOLVED
FIXED
Chunghwa Telecom
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
On March 19, 2024, Chunghwa Telecom's GTLSCA discovered an issue with incorrectly set Extended Key Usage (EKU) fields in 6,450 certificates. Although three certificates were revoked immediately, the remaining certificates were delayed due to the potential impact on subscribers, particularly government agencies. Following a comprehensive assessment, the CA initiated a reissuance program and began revoking the affected certificates in batches. By May 13, 2024, all certificates had been revoked. The CA committed to adhering strictly to Baseline Requirements (BR) for future incidents, ensuring timely revocation without grace periods.
Chronology
- GTLSCA received notification of EKU misissuance and began remediation.
- All affected certificates were revoked.
Thread Activity
- Cht representative — Created attachment detailing the incident report and impact assessment.
- Community commenter — Provided feedback on the impact assessment and requested more detailed information.
- Cht representative — Submitted closure summary detailing the incident and commitments for future compliance.
Participants
Cht representative
Community commenter
Mozilla representative
Sectigo
External References
Similar Local Cases
Chunghwa Telecom: Controversial Values within Extension (2.5.29.9, subjectDirectoryAttributes)
Chunghwa Telecom: Delayed Revocation with Controversial Extension (2.5.29.9, SubjectDirectoryAttributes)
Chunghwa Telecom: Failure to check restrictive CAA record during Migration
CFCA: Delayed revocation of TLS certificates(basicConstraints extension not marked as critical)
Telekom Security: Revocation delay for TLS certificates with basicConstraints not marked as critical
Entrust: Delayed revocation of clientAuth TLS Certificates without serverAuth EKU
GDCA: Delayed revocation of SSL/TLS certificates with Non-critical Basic Constraints
Entrust: Delayed revocation of EV TLS certificates with missing cPSuri