← Chunghwa Telecom cases
Bugzilla #1916392
Self Reported Incident
Revocation Issue
Chunghwa Telecom: TLS Certificates Contains two LocalityName Values in SubjectDN by GTLSCA
RESOLVED
FIXED
Chunghwa Telecom
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Chunghwa Telecom identified an issue where 247 TLS certificates contained two LocalityName values in the SubjectDN field during a routine cross-check on September 2, 2024. The problem originated from the previous CA, GCA, due to automated generation of certificate fields based on user location. Following the discovery, the CA halted certificate issuance, conducted an impact assessment, and reissued the affected certificates after correcting the issue. All affected certificates were revoked by September 6, 2024, and the CA committed to regular cross-checks to prevent future occurrences.
Chronology
- CA discovered two LocalityName values in SubjectDN during a routine inspection.
- All affected certificates were revoked.
- Closure summary provided and request for bug closure submitted.
Thread Activity
- Cht representative — Created incident report detailing the discovery of two localityName values in SubjectDN.
- Cht representative — All affected certificates are revoked, and we continue to monitor this issue.
- Cht representative — Provided closure summary detailing the incident and remediation steps.
Participants
Cht representative
Google representative
Mozilla representative
External References
Similar Local Cases
Chunghwa Telecom: “Test Website - Valid" URL disclosed to CCADB is expired
Chunghwa Telecom: outdated and stale policy documents disclosed to the CCADB
Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #4 - Missing evaluation for third parties
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #2 - Domain validation records without the TLS BR version
Chunghwa Telecom: Delayed audit disclosure for GTLSCA
Chunghwa Telecom: Delayed Annual Audit Report 2024
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #3 - Missing vulnerability scan