HARICA: TLS Server certificate issuance without proper validation

On January 23, 2025, HARICA was informed that a TLS Server certificate was issued without proper domain control validation due to a typo in the domain name. This led to a flaw in the validation code that allowed unvalidated domains to reuse domain control validation (DCV) evidence. HARICA suspended TLS certificate issuance, revoked the affected certificate within 24 hours, and implemented a fix the same day. A full audit confirmed no other certificates were affected. HARICA has committed to improving their validation processes and conducting further testing to prevent similar issues in the future.

1. 2025-01-23 HARICA was informed of a misissued TLS Server certificate.
2. 2025-01-24 The affected certificate was revoked.
3. 2025-05-16 HARICA submitted a closure summary for the incident.

1. 2025-01-24 HARICA — HARICA was informed by a Subscriber that a TLS Server certificate was issued without proper domain control validation.
2. 2025-01-31 HARICA — An incident report was submitted detailing the misissuance and the flaw in the validation code.
3. 2025-05-16 HARICA — HARICA submitted an incident closure summary outlining the root cause and remediation steps.