SSL.com: Entrust API and CAA checking

RESOLVED DUPLICATE Entrust

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

This case involves a report of a misissued wildcard certificate for the domain *.hyatt-test.com, which was issued by SSL.com despite a CAA record that should have prevented such issuance. The issue was triggered by a user who created a CAA record indicating no certificates should be issued for the domain. SSL.com acknowledged the report and initiated an investigation to determine if the issuance violated CAA policies. The investigation revealed ambiguity in the interpretation of RFC 8659 regarding the handling of CAA records, particularly concerning wildcard certificates. The case has been marked as a duplicate of another bug (1932973) that encompasses the underlying issues.

Model: gpt-4o-mini Generated: 2026-06-13 21:41 UTC Revised: 2026-06-16 18:59 UTC Confidence: 0.85 14 comments

Chronology

2024-11-15 A wildcard certificate for *.hyatt-test.com was issued when it should not have been.
2024-12-03 The bug was marked as a duplicate of Bug 1932973.

Thread Activity

2024-11-15 Community commenter — Reported the misissuance of a wildcard certificate despite a CAA record.
2024-11-19 SSL.com — Acknowledged the report and confirmed an investigation was initiated.
2024-12-03 Mozilla representative — Closed this bug as a duplicate of Bug 1932973.

Participants

Community commenter SSL.com Mozilla representative Entrust representative Sectigo Mm representative

External References

Original Bugzilla Case www.entrust.com crt.sh

Related Bugzilla IDs Mentioned

#1932973

Similar Local Cases

#1931615 RESOLVED Certificate Misissuance Opened 2024-11-15 · Closed 2024-12-03 · 88% similar

SSL.com: Entrust API and CAA checking

AI Summary CA Owner

#1815534 RESOLVED Ca Certificate Compliance Certificate Misissuance Revocation Issue Opened 2023-02-07 · Closed 2024-04-17 · 81% similar

e-commerce monitoring GmbH: SCT in precertificate

AI Summary CA Owner

#1932973 RESOLVED Certificate Misissuance Incident Opened 2024-11-22 · Closed 2025-04-07 · 76% similar

SSL.com: CAA Empty set handling results in Wildcard issuance

AI Summary CA Owner

#1793441 RESOLVED Ca Certificate Compliance Certificate Misissuance Opened 2022-10-03 · Closed 2023-02-22 · 73% similar

GlobalSign: CRL contains invalid signature algorithm

AI Summary CA Owner

#1887753 RESOLVED Certificate Misissuance Audit Finding Opened 2024-03-25 · Closed 2024-07-12 · 73% similar

Entrust: Delay in Updating CPS

AI Summary CA Owner

#1888714 RESOLVED Certificate Misissuance Opened 2024-03-29 · Closed 2024-07-11 · 73% similar

Entrust: EV Certificate missing Issuer’s EV Policy OID

AI Summary CA Owner

#1883843 RESOLVED Certificate Misissuance Opened 2024-03-06 · Closed 2024-08-13 · 72% similar

Entrust: EV TLS Certificate cPSuri missing

AI Summary CA Owner

#1744827 RESOLVED Certificate Misissuance Delayed Revocation Opened 2021-12-07 · Closed 2024-03-08 · 72% similar

Entrust: SSL Certificates issued with Un-verified IP Addresses

AI Summary CA Owner