← Microsoft Corporation cases
Bugzilla #1944436
Certificate Misissuance
Microsoft PKI Services: Subject Key Identifiers in Some Subscriber Certificates Do Not Comply with RFC 5280
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves a compliance issue identified in multiple Subscriber certificates issued by Microsoft PKI Services, where the subjectKeyIdentifier values were not unique as required by RFC 5280. The issue was reported by a researcher and triggered an internal investigation by Microsoft PKI Services. They confirmed that 19 certificates were affected, including 12 non-expired and 7 expired. Microsoft PKI Services has since revoked all impacted certificates and implemented additional validation checks to ensure compliance with RFC 5280 in future certificate requests. The case has been resolved with all action items completed.
Chronology
- Certificate Problem Report received from a researcher.
- Final impacted certificate was revoked.
- Validation check for subjectKeyIdentifier compliance was implemented.
- Evaluation of all certificate properties completed.
- Final Action Item closed.
Thread Activity
- Disabled representative — Preliminary incident report detailing the compliance issue.
- Disabled representative — Final incident report confirming the compliance issue and outlining the investigation.
- Disabled representative — Final Action Item was closed.
Participants
Disabled representative
Mozilla representative
Verbuecheln representative
Microsoft Corporation
Internet Security Research Group
External References
Similar Local Cases
Microsoft PKI Services: Invalid Email Address for CPRs
Microsoft PKI Services: CA Certificates not published in DER Encoded Format
Microsoft PKI Services: DV certificate issued with OV fields
Microsoft PKI Services: Underscore in SAN
Microsoft PKI Services: Certificate Mis-Issuance, Locality Missing
Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)
Microsoft PKI Services: Certificate Mis-Issuance, DNSNames must have a valid TLD
Microsoft PKI Services: Certificate Mis-Issuance, DNSName is not FQDN, Preferred Name Syntax