Telia incident report for 13 certificates issued with lowercase subject:countryName
Telia Company opened this bug to report an incident involving 13 misissued TLS certificates that used a lowercase value in the subject:countryName field. Telia said the issue was discovered after an external email report arrived on 2024-05-09, and it treated the case as an incident report with a follow-up full report to come. Telia stated that the affected certificates would be revoked and subscribers instructed to renew them, but it also said it could not revoke all of them within the 5-day timeframe and later filed a separate delayed revocation bug for the remainder. Telia then posted a full incident report describing the root cause as a validation defect in its issuance workflow and listed corrective actions, including fixing the certificate configuration wizard, making RA approval checks case-sensitive, and enforcing uppercase subject:countryName values. By late August, Telia said all action items were complete and asked whether the issue could be closed; Mozilla replied that it intended to close the bug on 2024-09-04 unless more questions arose.
- First certificate with lowercase subject:countryName was issued.
- Telia received an external report listing problematic certificates.
- Telia reported that not all affected certificates could be revoked within 5 days and opened a delayed revocation incident.
- Telia completed the final corrective software update in production.
- Teliacompany representative — Telia filed the initial incident report, described 13 misissued certificates, and said the affected certificates would be revoked and renewed.
- DigiCert — Corey asked for a reference supporting the claimed uppercase requirement.
- Community commenter — Wayne cited ISO 3166-1 chapter 5.1 and said the incident was related to a broader standards-interpretation issue.
- Mozilla representative — Mozilla said it agreed with Telia that country codes must be uppercase.
- Teliacompany representative — Telia posted the full incident report, including root cause, impact, and a detailed timeline.
- Teliacompany representative — Telia said two corrective actions were completed and one action remained for later in 2024.
- Teliacompany representative — Telia said the last pending action item was completed and asked whether the issue could be closed.
- Mozilla representative — Mozilla said it intended to close the bug on 2024-09-04 unless there were more questions.