FNMT: LDAP URI in CRL Distribution Points Extension

The Government of Spain's Fábrica Nacional de Moneda y Timbre (FNMT) reported a compliance issue involving 759 SSL/TLS certificates that were mis-issued with an LDAP URI in their CRL Distribution Points (CDP) extension, violating CAB/Forum Baseline Requirements. Upon discovering the issue on October 4, 2024, FNMT suspended certificate issuance and initiated an investigation. All affected certificates were revoked within five days. The root cause was identified as a failure to update the certificate profile checklist during the review of the new Baseline Requirements version. FNMT has since improved its monitoring systems and updated its procedures to prevent future occurrences.

1. 2024-10-04 FNMT discovers mis-issued certificates with LDAP URI in CDP extension.
2. 2024-10-11 All affected certificates are revoked.
3. 2025-02-04 Closure summary provided and case is set for closure.

1. 2024-10-05 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT received a notification about potentially mis-issued certificates and stopped issuance.
2. 2024-10-11 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — All affected certificates have been revoked.
3. 2025-02-04 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Closure summary provided detailing the incident and remediation.