Chunghwa Telecom: Controversial Values within Extension (2.5.29.9, subjectDirectoryAttributes)
Chunghwa Telecom identified a compliance issue involving the inclusion of a controversial value in the 2.5.29.9 (subjectDirectoryAttributes) extension of their certificates. Following an inquiry, they decided to remove this extension to comply with the Baseline Requirements (BR). The CA reported that a total of 12,911 certificates were affected, and they initiated a revocation process. However, the revocation timeline extended beyond the required 5-day period, prompting concerns about delayed revocation. Chunghwa Telecom has since acknowledged the issue and is working on a plan to revoke the affected certificates and improve compliance with their Certificate Policy. As of September 6, 2024, all action items related to this case have been completed, and the case is set to be closed.
- Chunghwa Telecom stopped issuing certificates containing the controversial extension.
- Chunghwa Telecom began reissuing certificates after removing the controversial extension.
- Chunghwa Telecom revoked 4,306 certificates, with plans to revoke the remaining affected certificates.
- Chunghwa Telecom confirmed completion of all action items related to the incident.
- Cht representative — Chunghwa Telecom reported the issue and outlined the actions taken to address the controversial extension.
- Sectigo — Tim Callan noted previous issues with Chunghwa Telecom's use of OID values.
- Cht representative — Chunghwa Telecom opened a new incident report regarding delayed revocation.
- Cht representative — Chunghwa Telecom requested the closure of the bug, stating all action items were completed.