← China Financial Certification Authority (CFCA) cases
Bugzilla #1949131
Self Reported Incident
CFCA: BasicConstraints are not marked as critical certificates are missing and therefore not revoked
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) reported a compliance issue where the basicConstraints extension of certain certificates was not marked as critical. This issue was initially identified in late March 2024, leading to the revocation of over 2,000 certificates issued between September 15, 2023, and March 19, 2024. Following a notification from Chris Clements on February 10, 2025, CFCA confirmed three additional certificates with the same issue and completed their revocation shortly thereafter. CFCA has since implemented measures to prevent similar issues in the future and has committed to ongoing improvements in compliance with the CA/B Forum Requirements.
Chronology
- CFCA completed the revocation of over 2,000 non-compliant certificates.
- CFCA was notified of three certificates with basicConstraints not marked as critical.
- CFCA completed the revocation of the three identified certificates.
Thread Activity
- China Financial Certification Authority (CFCA) — CFCA confirmed the issue and began revoking affected certificates.
- Google representative — Inquired about the timeline for the Full Incident Report.
- China Financial Certification Authority (CFCA) — Provided a detailed Full Incident Report addressing the compliance issue.
- Google representative — Requested clarification on related incidents and compliance with reporting guidelines.
- Community commenter — Filed a new bug to address the reporting timeline violation.
Participants
China Financial Certification Authority (CFCA)
Google representative
Community commenter
External References
Similar Local Cases
CFCA: Failed to respond a Certificate Problem Report within 24 hours which violates Section 4.9.5 of the TLS BRs
CFCA: DV OCA caIssuers Returns PEM Encoded Certificate (RFC 5280 Section 4.2.2.1 Violation)
CFCA: Failed to follow Report lifecycle rule to respond within 7 days
CFCA: reporting delayed when handling incident bug #2005399
CFCA: CRL signatureAlgorithm Missing NULL Parameter (RFC 4055 Section 5)
CFCA: OCSP Responder Certificate Profile Deviations and OCSP Service Issues
CFCA: Wrong SerialNumber encoding
CFCA: O > 64 characters