← Disig, a.s. cases
Bugzilla #1907667
Certificate Misissuance
Disig: Two certificates with same serial number
RESOLVED
FIXED
Disig, a.s.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Disig, a certificate authority, reported that it had issued two certificates with the same serial number but different extension orders. This issue was identified through the existence of two pre-certificates, leading to a potential violation of the uniqueness requirement for certificate serial numbers as per the Baseline Requirements. In response, Disig halted the issuance of TLS certificates and initiated an investigation. They later confirmed that the problem stemmed from a configuration error in their new CA signing software. Disig has since updated their software, resumed certificate issuance, and revoked the affected certificates. The case is now considered resolved.
Chronology
- Disig issued two certificates with the same serial number.
- Disig was notified of the issue and stopped issuing TLS certificates.
- Disig confirmed the root cause and began corrective actions.
- Disig resumed TLS certificate issuance after software updates.
Thread Activity
- Disig, a.s. — Disig was notified that it had issued two certificates with the same serial number.
- Disig, a.s. — This is the final report confirming the issue and the steps taken.
- Disig, a.s. — Disig considers the subject of this bug resolved and expects closure.
Participants
Disig, a.s.
Community commenter
Google representative
Mozilla representative
External References
Similar Local Cases
Disig: TLS certificate with basicConstraints not marked as critical
Disig: Non-BR-Compliant Certificate Issuance
Disig: Certificates with incorrect Subject attribute order
Disig: Certificates with invalid embedded SCT signature
GDCA: Issuance of SSL/TLS certificates with Non-critical Basic Constraints
Telia: Issued three precertificates with non-NIST EC curve
SECOM: Certificates Issued with lower case value in subject:countryName
Entrust: Failure to revoke EV TLS certificates issued before CPS update