← SSL.com cases
Bugzilla #1932973
Certificate Misissuance
Incident
SSL.com: CAA Empty set handling results in Wildcard issuance
RESOLVED
FIXED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SSL.com reported a compliance issue regarding the issuance of a wildcard TLS certificate due to a misinterpretation of CAA records. The incident was triggered by a Certificate Problem Report received on November 15, 2024, which indicated that the absence of an 'issuewild' property was incorrectly interpreted as permission to issue the wildcard certificate. Following an investigation, SSL.com acknowledged the violation of their own Certificate Policy and promptly revoked the certificate. They implemented a patch to prevent future occurrences and updated their testing procedures to include this edge case. The final incident report was submitted on December 4, 2024, and all action items have been completed.
Chronology
- SSL.com received a Certificate Problem Report regarding a potential mis-processing of CAA records.
- The wildcard certificate was revoked.
- SSL.com submitted the Final Incident Report.
Thread Activity
- SSL.com — SSL.com submitted a Preliminary Incident Report regarding the CAA issue.
- SSL.com — SSL.com submitted the Final Incident Report detailing the incident and remediation steps.
- Mozilla representative — Mozilla requested SSL.com to update the incident report for more detail.
- SSL.com — SSL.com provided an Incident Report Closure Summary.
Participants
SSL.com
Mozilla representative
Mm representative
External References
Similar Local Cases
SSL.com: Delay in publishing OCSP responses
SSL.com: Failure to process CAA records from one SubCA
SSL.com: Incorrect Domain Validation for 1 TLS certificate with FQDN having "www." string within domain labels
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
SSL.com: Wildcard DV certificate issued with a non-validated domain name
SSL.com: Issuance of certificates using keys previously reported as compromised
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: S/MIME certificates issued prior to validation