← SSL.com cases
Bugzilla #1932973
Certificate Problem Report
SSL.com: CAA Empty set handling results in Wildcard issuance
RESOLVED
FIXED
SSL.com
AI Summary
SSL.com faced a Certificate Problem Report regarding the issuance of a wildcard TLS certificate due to a misinterpretation of the CAA record 'issue' ';'. The investigation revealed that the CAA validator incorrectly allowed the issuance based on the absence of an 'issuewild' property, violating SSL.com's CP/CPS. A patch was deployed to prevent future occurrences, and the issue was confirmed to affect only the reported certificate. SSL.com has since updated its testing procedures to include this edge case.
Chronology
- SSL.com received a Certificate Problem Report regarding a potential mis-issuance.
- The wildcard certificate was revoked.
- SSL.com concluded the issuance was a violation of their CP/CPS.
- SSL.com submitted an updated incident report addressing community concerns.
Participants
secauditor@ssl.com
bwilson@mozilla.com
rebeccak@ssl.com
agwa-bugs@mm.beanwood.com
External References
Similar Local Cases
SSL.com: Failure to process CAA records from one SubCA
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
SSL.com: Issuance of an EV TLS certificate with incorrect O Field Value
SSL.com: DCV bypass and issue fake certificates for any MX hostname
SSL.com: Issuance of 1 EV TLS certificate using a Registration/Incorporation Agency not included in our approved public list.
SSL.com: "unknown" OCSP response for issued certificates
SSL.com: Insufficient validation evidence for the localityName attribute of an OV certificate
SSL.com: Delayed revocation of certificate with weak key